# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
country_id: 3932488
description:
2025-02-06 00:53:27 dovecot_plain authenticator failed for ([200.37.179.83]) [200.37.179.83]:37872: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
country_id: 1814991
description:
2025-02-06 00:53:02 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:45912: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2025-02-06 00:53:13 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:49082: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 00:53:27 dovecot_plain authenticator failed for ([216.194.174.80]) [216.194.174.27]:26378: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
country_id: 1835841
description:
2025-02-06 00:53:45 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:60417: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.200.154.39
country_id: 2921044
description:
Feb  6 00:54:03 ait sshd[894203]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.200.154.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.233.34.152
country_id: 1814991
description:
2025-02-06 00:54:20 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [42.233.34.152]:22711: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.233.41.224
country_id: 298795
description:
[2025-02-06 00:53:30 +0100] info [webmaild] 178.233.41.224 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-02-06 00:53:29 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:55298: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.71.107
country_id: 1814991
description:
2025-02-06 00:53:40 dovecot_plain authenticator failed for ([36.32.223.199]) [58.242.71.107]:47684: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.233.34.152
country_id: 1814991
description:
Feb  6 00:54:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.233.34.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.72.147.10
country_id: 1814991
description:
2025-02-06 00:53:41 dovecot_plain authenticator failed for ([180.166.163.26]) [222.72.147.10]:55970: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 57.128.47.31
country_id: 3017382
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-53.57.128.47.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
country_id: 1814991
description:
2025-02-06 00:53:33 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:45768: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.172.72
country_id: 1819730
description:
2025-02-06 00:53:42 dovecot_plain authenticator failed for (223-197-172-72.static.imsbiz.com) [223.197.172.72]:49753: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.200.154.39
country_id: 2921044
description:
Feb  6 00:54:03 ait sshd[894203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.200.154.39  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.10.53.109
country_id: 1562822
description:
Feb  6 00:54:17 ait sshd[894432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.10.53.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-06 00:53:42 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:35114: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
country_id: 6251999
description:
2025-02-06 00:53:49 dovecot_login authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:33372: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
country_id: 1821275
description:
2025-02-06 00:54:07 dovecot_login authenticator failed for ([103.237.100.136]) [103.237.100.136]:43194: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
country_id: 2750405
description:
2025-02-06 00:53:44 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:36842: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.18.217
country_id: 1814991
description:
2025-02-06 00:54:10 dovecot_plain authenticator failed for ([117.175.18.217]) [117.175.18.217]:57876: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
country_id: 1814991
description:
2025-02-06 00:53:31 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:36866: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
country_id: 6252001
description:
2025-02-06 00:54:12 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:58928: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.106.178.198
country_id: 3469034
description:
[2025-02-06 00:54:15 +0100] info [webmaild] 179.106.178.198 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.10.53.109
country_id: 1562822
description:
Feb  6 00:54:17 ait sshd[894432]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.10.53.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-02-06 00:53:35 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:57154: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
country_id: 1835841
description:
2025-02-06 00:53:37 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:37337: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.148.231.42
country_id: 3469034
description:
[2025-02-06 00:54:00 +0100] info [webmaild] 186.148.231.42 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
country_id: 2017370
description:
2025-02-06 00:55:13 dovecot_plain authenticator failed for ([95.165.72.156]) [95.165.72.156]:34798: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.177.209.66
country_id: 1814991
description:
2025-02-06 00:54:44 dovecot_plain authenticator failed for ([42.177.209.66]) [42.177.209.66]:33995: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.13.2
country_id: 1814991
description:
Feb  6 00:55:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.13.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
country_id: 2017370
description:
2025-02-06 00:55:10 dovecot_plain authenticator failed for (unbord) [77.239.255.163]:48776: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.239.190.251
country_id: 1814991
description:
2025-02-06 00:54:53 dovecot_plain authenticator failed for ([183.239.190.251]) [183.239.190.251]:42090: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.13.2
country_id: 1814991
description:
2025-02-06 00:55:06 dovecot_plain authenticator failed for ([183.236.13.2]) [183.236.13.2]:44311: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
country_id: 2017370
description:
Feb  6 00:55:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-06 00:55:22 dovecot_plain authenticator failed for ([216.194.174.74]) [216.194.174.27]:62174: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
country_id: 1814991
description:
2025-02-06 00:54:34 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:59368: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
country_id: 6252001
description:
2025-02-06 00:54:46 dovecot_plain authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:60216: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.71.47.14
country_id: 1210997
description:
[2025-02-06 00:54:53 +0100] info [webmaild] 103.71.47.14 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
country_id: 6252001
description:
Feb  6 00:55:33 ait sshd[894859]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
country_id: 6252001
description:
Feb  6 00:55:33 ait sshd[894859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
country_id: 1562822
description:
Feb  6 00:56:02 ait sshd[894994]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
country_id: 1562822
description:
Feb  6 00:56:02 ait sshd[894994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.98.200
country_id: 3469034
description:
[2025-02-06 00:56:03 +0100] info [webmaild] 131.196.98.200 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 00:55:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.114.194.46
country_id: 1814991
description:
Feb  6 00:55:58 ait sshd[894973]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.114.194.46 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.114.194.46
country_id: 1814991
description:
Feb  6 00:55:58 ait sshd[894973]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.114.194.46  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.28.91.125
country_id: 3923057
description:
[2025-02-06 00:56:31 +0100] info [webmaild] 189.28.91.125 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:00-56.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.224.68
country_id: 3469034
description:
[2025-02-06 00:56:48 +0100] info [webmaild] 138.219.224.68 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 00:57:50 ait sshd[895534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 00:57:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.185.223
country_id: 3865483
description:
[2025-02-06 00:57:37 +0100] info [webmaild] 45.70.185.223 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 00:57:39 ait sshd[895482]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 00:57:39 ait sshd[895482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.113.66.20
country_id: 2635167
description:
Feb  6 00:58:20 ait sshd[895716]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.113.66.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.113.66.20
country_id: 2635167
description:
Feb  6 00:58:20 ait sshd[895716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.113.66.20  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 00:57:50 ait sshd[895534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.248.239.19
country_id: 3469034
description:
[2025-02-06 00:59:02 +0100] info [webmaild] 191.248.239.19 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.143.49.44
country_id: 3469034
description:
[2025-02-06 00:59:22 +0100] info [webmaild] 177.143.49.44 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.214.172
country_id: 3469034
description:
[2025-02-06 00:58:32 +0100] info [webmaild] 191.7.214.172 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-06 00:58:38 dovecot_plain authenticator failed for (wunispeang) [109.166.70.166]:62445: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
country_id: 1835841
description:
Feb  6 01:00:14 ait sshd[896576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.70
country_id: 6252001
description:
Feb  6 01:00:22 ait sshd[896586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.70


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.172.92.133
country_id: 3865483
description:
[2025-02-06 00:59:57 +0100] info [webmaild] 190.172.92.133 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 01:00:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.22.238.192
country_id: 3865483
description:
[2025-02-06 01:01:07 +0100] info [webmaild] 186.22.238.192 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.80.3.139
country_id: 3469034
description:
[2025-02-06 01:02:04 +0100] info [webmaild] 201.80.3.139 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.239.246.153
country_id: 2921044
description:
2025-02-06 01:02:06 dovecot_login authenticator failed for 213-239-246-153.clients.your-server.de [213.239.246.153]:48714: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
country_id: 1814991
description:
2025-02-06 01:02:15 dovecot_login authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:52230: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 01:01:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.253.189.71
country_id: 3932488
description:
[2025-02-06 01:01:37 +0100] info [webmaild] 38.253.189.71 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.35.142.125
country_id: 3469034
description:
[2025-02-06 01:02:38 +0100] info [webmaild] 189.35.142.125 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.123.32
country_id: 1880251
description:
Feb  6 01:03:01 ait sshd[897845]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.123.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.123.32
country_id: 1880251
description:
Feb  6 01:03:01 ait sshd[897845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.123.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 01:03:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 01:03:26 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:33883: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.172.46.10
country_id: 6252001
description:
Feb  6 01:04:10 ait sshd[898278]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.172.46.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 01:04:23 ait sshd[898417]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.90.169.209
country_id: 6252001
description:
Feb  6 01:04:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.90.169.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.90.169.209
country_id: 6252001
description:
2025-02-06 01:04:17 dovecot_plain authenticator failed for syn-024-090-169-209.res.spectrum.com (siopopolam) [24.90.169.209]:47045: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2025-02-06 01:03:38 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:26856: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 01:03:40 ait sshd[898167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
country_id: 6252001
description:
Feb  6 01:04:10 ait sshd[898278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.88
country_id: 1512440
description:
[2025-02-06 01:04:11 +0100] info [webmaild] 84.54.73.88 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 01:04:23 ait sshd[898417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 01:03:40 ait sshd[898167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.211.197.94
country_id: 289688
description:
[2025-02-06 01:03:42 +0100] info [webmaild] 89.211.197.94 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.221.21
country_id: 1814991
description:
2025-02-06 01:04:08 dovecot_login authenticator failed for ([219.145.221.21]) [219.145.221.21]:44740: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
country_id: 1269750
description:
Feb  6 01:05:23 ait sshd[898922]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
country_id: 1269750
description:
Feb  6 01:05:23 ait sshd[898922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.70.46
country_id: 3469034
description:
[2025-02-06 01:04:45 +0100] info [webmaild] 177.124.70.46 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
country_id: 2077456
description:
2025-02-06 01:05:09 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:1516: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.51.86.207
country_id: 3469034
description:
[2025-02-06 01:05:20 +0100] info [webmaild] 201.51.86.207 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-02-06 01:04:43 dovecot_login authenticator failed for ([36.39.140.2]) [36.39.140.2]:53903: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-02-06 01:04:53 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:41948: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 01:05:51 ait sshd[898998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
country_id: 1880251
description:
2025-02-06 01:05:53 dovecot_plain authenticator failed for (80-184-100-101.myrepublic.com.sg) [218.212.153.73]:52288: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
country_id: 3469034
description:
2025-02-06 01:06:04 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:34538: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.119.207.61
country_id: 2400553
description:
[2025-02-06 01:06:09 +0100] info [webmaild] 154.119.207.61 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.110.62.21
country_id: 1814991
description:
2025-02-06 01:06:19 dovecot_plain authenticator failed for ([180.110.62.21]) [180.110.62.21]:58378: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 01:05:51 ait sshd[898998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.104
country_id: 1668284
description:
2025-02-06 01:06:04 dovecot_plain authenticator failed for 111-70-49-104.emome-ip.hinet.net [111.70.49.104]:50468: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
country_id: 1814991
description:
2025-02-06 01:05:48 dovecot_login authenticator failed for ([60.174.40.155]) [60.174.40.155]:50694: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.81
country_id: 1814991
description:
2025-02-06 01:05:58 dovecot_login authenticator failed for ([183.237.61.147]) [113.117.173.81]:47430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
country_id: 1814991
description:
Feb  6 01:05:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 01:06:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.159.138
country_id: 1835841
description:
Feb  6 01:07:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.159.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.146.145
country_id: 3469034
description:
[2025-02-06 01:06:39 +0100] info [webmaild] 186.219.146.145 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.152
country_id: 99237
description:
2025-02-06 01:06:49 dovecot_plain authenticator failed for (ounds) [65.20.253.152]:39977: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.159.138
country_id: 1835841
description:
2025-02-06 01:07:06 dovecot_plain authenticator failed for ([218.149.159.138]) [218.149.159.138]:40383: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2025-02-06 01:07:19 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:60916: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.81.74.108
country_id: 1814991
description:
2025-02-06 01:08:24 dovecot_plain authenticator failed for ([117.81.74.108]) [117.81.74.108]:42891: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 01:07:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.90.252
country_id: 1880251
description:
Feb  6 01:07:57 ait sshd[899529]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.90.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.223.47.8
country_id: 1880251
description:
Feb  6 01:08:11 ait sshd[899569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.47.8


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.82.30
country_id: 3469034
description:
[2025-02-06 01:07:38 +0100] info [webmaild] 177.137.82.30 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.185
country_id: 2635167
description:
Feb  6 01:07:45 ait sshd[899522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.185


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.47.8
country_id: 1880251
description:
Feb  6 01:08:11 ait sshd[899569]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.223.47.8 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.90.252
country_id: 1880251
description:
Feb  6 01:07:57 ait sshd[899529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.90.252  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.17.230.168
country_id: 3469034
description:
[2025-02-06 01:08:14 +0100] info [webmaild] 187.17.230.168 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.81.74.108
country_id: 1814991
description:
Feb  6 01:08:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.81.74.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.185
country_id: 2635167
description:
Feb  6 01:07:45 ait sshd[899522]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.146.113.5
country_id: 587116
description:
[2025-02-06 01:08:43 +0100] info [webmaild] 185.146.113.5 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.107.135
country_id: 1814991
description:
2025-02-06 01:08:46 dovecot_plain authenticator failed for ([222.85.107.135]) [222.85.107.135]:42308: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.240
country_id: 1668284
description:
2025-02-06 01:08:59 dovecot_plain authenticator failed for 111-70-21-240.emome-ip.hinet.net [111.70.21.240]:48443: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 01:09:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.135.174.107
country_id: 192950
description:
[2025-02-06 01:09:13 +0100] info [webmaild] 102.135.174.107 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 01:09:18 ait sshd[900236]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-06 01:08:36 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:10957: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-06 01:08:47 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:59438: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
country_id: 2635167
description:
2025-02-06 01:08:56 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (drotailly) [81.143.51.58]:39051: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 01:09:18 ait sshd[900236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.248.46
country_id: 1814991
description:
2025-02-06 01:09:21 dovecot_plain authenticator failed for ([222.75.248.46]) [222.75.248.46]:47724: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Feb  6 01:09:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.65.54.204
country_id: 1835841
description:
2025-02-06 01:10:14 dovecot_plain authenticator failed for ([121.65.54.204]) [121.65.54.204]:59826: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-06 01:10:17 dovecot_login authenticator failed for ([109.166.70.166]) [109.166.70.166]:58045: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 01:10:09 ait sshd[900494]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 01:10:09 ait sshd[900494]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.89.80
country_id: 3658394
description:
[2025-02-06 01:10:10 +0100] info [webmaild] 157.100.89.80 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-02-06 01:10:15 dovecot_login authenticator failed for 137.173.198.203.static.netvigator.com [203.198.173.137]:51140: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.225.240
country_id: 290557
description:
2025-02-06 01:10:23 dovecot_plain authenticator failed for ([94.204.225.240]) [94.204.225.240]:42048: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 01:10:43 ait sshd[900755]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
country_id: 2510769
description:
Feb  6 01:10:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
country_id: 1835841
description:
2025-02-06 01:10:45 dovecot_login authenticator failed for ([211.35.237.38]) [211.35.237.38]:52486: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 01:11:00 ait sshd[900830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.113.74.46
country_id: 2635167
description:
Feb  6 01:11:19 ait sshd[901042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.113.74.46  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.113.74.46
country_id: 2635167
description:
Feb  6 01:11:19 ait sshd[901042]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.113.74.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
country_id: 3017382
description:
2025-02-06 01:10:34 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:44141: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
country_id: 2510769
description:
2025-02-06 01:10:53 dovecot_login authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:36320: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 01:11:00 ait sshd[900830]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 01:10:43 ait sshd[900755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.42.27.75
country_id: 3895114
description:
[2025-02-06 01:10:46 +0100] info [webmaild] 181.42.27.75 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-11.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
country_id: 2921044
description:
2025-02-06 01:11:16 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:48975: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.190.139.137
country_id: 6252001
description:
Feb  6 01:11:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.190.139.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
country_id: 1269750
description:
2025-02-06 01:12:00 dovecot_login authenticator failed for ([103.190.91.113]) [103.190.91.113]:35870: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.114.82
country_id: 1880251
description:
47.128.114.82 - - [06/Feb/2025:01:12:10 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18080411" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.114.82


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.33
country_id: 1512440
description:
[2025-02-06 01:11:28 +0100] info [webmaild] 213.230.93.33 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-06 01:11:37 dovecot_plain authenticator failed for ([58.49.113.138]) [58.49.113.138]:17290: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.139.137
country_id: 6252001
description:
2025-02-06 01:11:46 dovecot_login authenticator failed for ([50.190.139.137]) [50.190.139.137]:57174: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.34.174.25
country_id: 3469034
description:
[2025-02-06 01:11:59 +0100] info [webmaild] 179.34.174.25 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.19.97
country_id: 1880251
description:
47.128.19.97 - - [06/Feb/2025:01:12:18 +0100] "GET /wp-content/plugins/elementskit/widgets/init/assets/css/widget-styles-pro.css?ver=3.3.0 HTTP/2.0" 200 1537 elibrary.ait-edu.us "https://elibrary.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22920333" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.19.97


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.243.154.191
country_id: 298795
description:
[2025-02-06 01:13:16 +0100] info [webmaild] 88.243.154.191 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
country_id: 1835841
description:
2025-02-06 01:13:21 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:60572: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
country_id: 1835841
description:
2025-02-06 01:13:28 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:42854: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.47.185
country_id: 3469034
description:
[2025-02-06 01:12:41 +0100] info [webmaild] 138.219.47.185 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 01:12:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
country_id: 3144096
description:
Feb  6 01:13:10 ait sshd[901665]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
country_id: 3144096
description:
Feb  6 01:13:10 ait sshd[901665]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 01:13:30 ait sshd[901821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.63.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
country_id: 1269750
description:
2025-02-06 01:13:38 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:56572: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.216.216.57
country_id: 3469034
description:
[2025-02-06 01:14:04 +0100] info [webmaild] 186.216.216.57 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-02-06 01:14:21 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:50656: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 01:13:30 ait sshd[901821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.63.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
country_id: 6252001
description:
2025-02-06 01:13:34 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:45867: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
country_id: 1835841
description:
2025-02-06 01:14:15 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:48758: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 01:14:50 ait sshd[902219]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 01:14:50 ait sshd[902219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-06 01:15:18 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (mette) [80.14.31.158]:36779: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.14.155
country_id: 3469034
description:
[2025-02-06 01:15:26 +0100] info [webmaild] 177.221.14.155 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-02-06 01:14:46 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:48980: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.63.214.213
country_id: 1814991
description:
2025-02-06 01:14:40 dovecot_plain authenticator failed for ([218.15.222.74]) [58.63.214.213]:55784: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
country_id: 1562822
description:
2025-02-06 01:14:56 dovecot_plain authenticator failed for ([115.75.188.242]) [115.75.188.242]:37822: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
country_id: 1269750
description:
Feb  6 01:14:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.222.190.0
country_id: 3469034
description:
[2025-02-06 01:14:34 +0100] info [webmaild] 179.222.190.0 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 01:14:45 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:36670: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
country_id: 2635167
description:
2025-02-06 01:15:10 dovecot_plain authenticator failed for (heatics) [185.65.238.250]:38897: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-02-06 01:14:33 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:52326: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 01:15:29 ait sshd[902529]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.244.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2025-02-06 01:16:19 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:41981: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 01:15:37 ait sshd[902549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-06 01:16:10 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:56220: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 01:15:29 ait sshd[902529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.244.88


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Feb  6 01:15:37 ait sshd[902549]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.209.139.182
country_id: 1512440
description:
[2025-02-06 01:15:50 +0100] info [webmaild] 62.209.139.182 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.26.214.99
country_id: 2464461
description:
[2025-02-06 01:17:09 +0100] info [webmaild] 197.26.214.99 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.153.85.132
country_id: 102358
description:
2025-02-06 01:17:23 dovecot_plain authenticator failed for ([46.153.85.132]) [46.153.85.132]:42426: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.155.172.27
country_id: 3469034
description:
[2025-02-06 01:16:41 +0100] info [webmaild] 177.155.172.27 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.212.54
country_id: 2921044
description:
Feb  6 01:16:50 ait sshd[902908]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.212.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.212.54
country_id: 2921044
description:
Feb  6 01:16:50 ait sshd[902908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.212.54  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
country_id: 2510769
description:
2025-02-06 01:17:33 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:13015: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
country_id: 1814991
description:
2025-02-06 01:17:37 dovecot_plain authenticator failed for ([1.24.210.27]) [1.24.210.27]:54154: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
country_id: 1835841
description:
2025-02-06 01:17:50 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:56538: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 01:18:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.131.138.128
country_id: 3658394
description:
[2025-02-06 01:18:25 +0100] info [webmaild] 190.131.138.128 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
country_id: 1819730
description:
2025-02-06 01:17:35 dovecot_plain authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:10891: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
country_id: 6252001
description:
2025-02-06 01:17:48 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:59273: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.109.48.99
country_id: 2017370
description:
[2025-02-06 01:17:51 +0100] info [webmaild] 213.109.48.99 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-06 01:19:01 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:50427: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 01:19:03 ait sshd[903730]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.49.100.200
country_id: 3865483
description:
[2025-02-06 01:19:09 +0100] info [webmaild] 190.49.100.200 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 01:19:03 ait sshd[903730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
country_id: 1814991
description:
2025-02-06 01:19:14 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:46294: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-06 01:19:19 dovecot_plain authenticator failed for (cytivery) [88.87.84.104]:52159: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 01:19:53 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:43484: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.100.159
country_id: 6252001
description:
Feb  6 01:19:54 ait sshd[903950]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.100.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
country_id: 2017370
description:
2025-02-06 01:20:00 dovecot_plain authenticator failed for ([88.87.84.104]) [88.87.84.104]:55818: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
country_id: 1835841
description:
2025-02-06 01:20:21 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:37154: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.106.188.62
country_id: 3469034
description:
[2025-02-06 01:19:39 +0100] info [webmaild] 189.106.188.62 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2025-02-06 01:19:39 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:33962: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.85.194
country_id: 1814991
description:
Feb  6 01:19:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.85.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2025-02-06 01:19:34 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:32792: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
country_id: 3469034
description:
2025-02-06 01:19:38 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:43832: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.100.159
country_id: 6252001
description:
Feb  6 01:19:54 ait sshd[903950]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.100.159  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.85.194
country_id: 1814991
description:
2025-02-06 01:19:55 dovecot_plain authenticator failed for ([183.233.85.194]) [183.233.85.194]:36058: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
country_id: 617790
description:
2025-02-06 01:19:49 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:46200: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.39.65.168
country_id: 953987
description:
[2025-02-06 01:20:30 +0100] info [webmaild] 102.39.65.168 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.73.35
country_id: 3469034
description:
[2025-02-06 01:21:12 +0100] info [webmaild] 179.0.73.35 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 01:21:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 01:22:19 ait sshd[904933]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 01:22:19 ait sshd[904933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.182.62
country_id: 3469034
description:
[2025-02-06 01:21:39 +0100] info [webmaild] 45.183.182.62 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
country_id: 933860
description:
2025-02-06 01:21:42 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:33539: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
country_id: 390903
description:
2025-02-06 01:21:53 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:55564: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
country_id: 1835841
description:
Feb  6 01:22:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.185.187
country_id: 3469034
description:
[2025-02-06 01:22:09 +0100] info [webmaild] 143.0.185.187 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.63.136.218
country_id: 1814991
description:
2025-02-06 01:22:49 dovecot_plain authenticator failed for ([183.63.136.218]) [183.63.136.218]:50603: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 01:23:26 ait sshd[905264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
country_id: 1835841
description:
2025-02-06 01:22:30 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:33190: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 01:23:26 ait sshd[905264]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.230
country_id: 1880251
description:
47.128.43.230 - - [06/Feb/2025:01:22:31 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20910365 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/697c04?panel=form" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.230


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.154.87
country_id: 3017382
description:
Feb  6 01:22:34 ait sshd[905082]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.154.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.154.87
country_id: 3017382
description:
Feb  6 01:22:34 ait sshd[905082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.154.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.80.112.245
country_id: 6252001
description:
Feb  6 01:22:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.80.112.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.135.152
country_id: 3469034
description:
[2025-02-06 01:22:59 +0100] info [webmaild] 138.204.135.152 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.196
country_id: 294640
description:
Feb  6 01:23:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.196
country_id: 294640
description:
2025-02-06 01:23:23 dovecot_login authenticator failed for (2-55-85-196.orange.net.il) [2.55.85.196]:35995: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
country_id: 2287781
description:
2025-02-06 01:24:00 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:62079: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
country_id: 298795
description:
2025-02-06 01:24:09 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:33180: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
country_id: 1814991
description:
2025-02-06 01:24:11 dovecot_plain authenticator failed for ([60.172.41.103]) [60.172.41.103]:34236: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.31.174
country_id: 1814991
description:
2025-02-06 01:24:25 dovecot_plain authenticator failed for ([183.245.31.174]) [183.245.31.174]:57924: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.31.174
country_id: 1814991
description:
Feb  6 01:24:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.31.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.68.1
country_id: 3469034
description:
[2025-02-06 01:23:31 +0100] info [webmaild] 170.245.68.1 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
country_id: 1835841
description:
Feb  6 01:23:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
country_id: 1814991
description:
Feb  6 01:24:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
country_id: 6252001
description:
Feb  6 01:24:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
country_id: 6252001
description:
2025-02-06 01:24:12 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:52416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-06 01:24:24 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:50457: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 01:23:53 ait sshd[905538]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.42.49.84
country_id: 3895114
description:
[2025-02-06 01:24:12 +0100] info [webmaild] 181.42.49.84 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.41.103
country_id: 1814991
description:
Feb  6 01:24:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.41.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 01:24:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.178
country_id: 2635167
description:
Feb  6 01:24:28 ait sshd[905783]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.178
country_id: 2635167
description:
Feb  6 01:24:28 ait sshd[905783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.178  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
country_id: 1835841
description:
2025-02-06 01:23:52 dovecot_login authenticator failed for ([106.246.6.133]) [106.246.6.133]:37122: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
country_id: 6252001
description:
Feb  6 01:23:53 ait sshd[905538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
country_id: 2287781
description:
Feb  6 01:23:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
country_id: 298795
description:
Feb  6 01:24:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 01:24:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Feb  6 01:24:32 ait sshd[905786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.252.161
country_id: 3469034
description:
[2025-02-06 01:24:42 +0100] info [webmaild] 143.0.252.161 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
country_id: 1835841
description:
Feb  6 01:24:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.239.78.124
country_id: 1819730
description:
Feb  6 01:25:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.239.78.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2025-02-06 01:24:52 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:64426: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.130
country_id: 1835841
description:
Feb  6 01:25:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.130
country_id: 1835841
description:
2025-02-06 01:25:17 dovecot_login authenticator failed for ([119.198.191.130]) [119.198.191.130]:52322: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Feb  6 01:24:32 ait sshd[905786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.78.124
country_id: 1819730
description:
2025-02-06 01:25:08 dovecot_plain authenticator failed for ([182.239.78.124]) [182.239.78.124]:34918: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.94.145
country_id: 3469034
description:
[2025-02-06 01:25:34 +0100] info [webmaild] 177.11.94.145 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
country_id: 1835841
description:
Feb  6 01:25:36 ait sshd[906400]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
country_id: 1835841
description:
Feb  6 01:25:36 ait sshd[906400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-25.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.23.157.20
country_id: 3865483
description:
[2025-02-06 01:26:09 +0100] info [webmaild] 181.23.157.20 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.219.157
country_id: 290557
description:
Feb  6 01:25:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.219.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.219.157
country_id: 290557
description:
2025-02-06 01:25:32 dovecot_login authenticator failed for ([94.205.219.157]) [94.205.219.157]:57186: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 01:26:17 ait sshd[906486]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 01:26:17 ait sshd[906486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.183.37.254
country_id: 3469034
description:
[2025-02-06 01:26:43 +0100] info [webmaild] 191.183.37.254 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.180.88.72
country_id: 6252001
description:
2025-02-06 01:26:53 dovecot_plain authenticator failed for static-47-180-88-72.lsan.ca.frontiernet.net ([65.255.196.42]) [47.180.88.72]:57162: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.10.44.126
country_id: 1562822
description:
Feb  6 01:27:03 ait sshd[906650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.10.44.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
country_id: 1814991
description:
Feb  6 01:27:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.174.147
country_id: 2077456
description:
2025-02-06 01:27:09 dovecot_plain authenticator failed for (unknown.bwdc.fsg.ordnance.co) [103.79.174.147]:57791: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.92.149.1
country_id: 3865483
description:
Feb  6 01:27:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.92.149.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
country_id: 6252001
description:
2025-02-06 01:27:24 dovecot_login authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:37557: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
country_id: 6252001
description:
Feb  6 01:27:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  6 01:26:45 ait sshd[906636]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
country_id: 1814991
description:
2025-02-06 01:27:07 dovecot_plain authenticator failed for ([39.155.170.146]) [39.155.170.146]:34205: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 01:27:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.88.72
country_id: 6252001
description:
Feb  6 01:26:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.180.88.72 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.44.126
country_id: 1562822
description:
Feb  6 01:27:03 ait sshd[906650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.44.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.174.147
country_id: 2077456
description:
Feb  6 01:27:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.174.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 01:27:09 ait sshd[906691]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.239.165.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 01:27:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2025-02-06 01:27:14 dovecot_login authenticator failed for ([200.168.190.81]) [200.159.14.187]:39314: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.24.185.98
country_id: 2017370
description:
Feb  6 01:27:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.24.185.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
country_id: 6252001
description:
Feb  6 01:26:45 ait sshd[906636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.92.149.1
country_id: 3865483
description:
2025-02-06 01:27:17 dovecot_plain authenticator failed for ([157.92.149.1]) [157.92.149.1]:33233: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.185.98
country_id: 2017370
description:
2025-02-06 01:27:28 dovecot_plain authenticator failed for ([217.24.185.98]) [217.24.185.98]:36624: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
country_id: 2464461
description:
Feb  6 01:27:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.95.88.164
country_id: 953987
description:
[2025-02-06 01:27:14 +0100] info [webmaild] 197.95.88.164 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.239.165.120
country_id: 1643084
description:
Feb  6 01:27:09 ait sshd[906691]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.239.165.120  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
country_id: 3469034
description:
Feb  6 01:27:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
country_id: 1668284
description:
2025-02-06 01:27:11 dovecot_plain authenticator failed for ([58.115.53.66]) [58.115.53.66]:54979: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
country_id: 2464461
description:
2025-02-06 01:27:12 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:60325: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 01:27:23 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:47974: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.158.77.43
country_id: 6252001
description:
Feb  6 01:28:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.158.77.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.158.77.43
country_id: 6252001
description:
2025-02-06 01:28:12 dovecot_login authenticator failed for ec2-54-158-77-43.compute-1.amazonaws.com (ait.edu.gh) [54.158.77.43]:55665: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.104.179.247
country_id: 1512440
description:
[2025-02-06 01:28:18 +0100] info [webmaild] 193.104.179.247 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.154.87
country_id: 3017382
description:
Feb  6 01:27:40 ait sshd[906871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.154.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.154.87
country_id: 3017382
description:
Feb  6 01:27:40 ait sshd[906871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.154.87


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.154.87
country_id: 3017382
description:
Feb  6 01:28:46 ait sshd[907235]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.154.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.154.87
country_id: 3017382
description:
Feb  6 01:28:46 ait sshd[907235]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.154.87


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.154.87
country_id: 3017382
description:
Feb  6 01:28:48 ait sshd[907235]: Failed password for invalid user deploy from 54.37.154.87 port 39312 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.227.18.114
country_id: 3469034
description:
[2025-02-06 01:28:37 +0100] info [webmaild] 168.227.18.114 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 01:29:04 ait sshd[907335]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.24.58
country_id: 1880251
description:
47.128.24.58 - - [06/Feb/2025:01:29:22 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27112073 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?filter_course-language=120%2C95&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.24.58


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.119.43
country_id: 3469034
description:
[2025-02-06 01:29:25 +0100] info [webmaild] 143.255.119.43 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 01:29:04 ait sshd[907335]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
country_id: 3469034
description:
Feb  6 01:30:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
country_id: 3469034
description:
2025-02-06 01:30:25 dovecot_plain authenticator failed for ([186.200.71.115]) [189.56.217.183]:43046: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.74.236.217
country_id: 3469034
description:
[2025-02-06 01:29:52 +0100] info [webmaild] 177.74.236.217 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  6 01:30:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-06 01:30:12 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (unfury) [91.56.31.167]:63092: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 01:29:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.29
country_id: 1512440
description:
[2025-02-06 01:30:39 +0100] info [webmaild] 213.230.86.29 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
country_id: 290557
description:
Feb  6 01:31:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
country_id: 290557
description:
2025-02-06 01:31:03 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:35644: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
country_id: 1814991
description:
Feb  6 01:31:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
country_id: 1814991
description:
2025-02-06 01:31:15 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:59776: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.134.110
country_id: 1814991
description:
Feb  6 01:30:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.134.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.134.110
country_id: 1814991
description:
2025-02-06 01:30:40 dovecot_plain authenticator failed for ([61.143.134.110]) [61.143.134.110]:57827: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.128.77.39
country_id: 3865483
description:
[2025-02-06 01:31:13 +0100] info [webmaild] 186.128.77.39 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.110
country_id: 99237
description:
Feb  6 01:32:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
country_id: 1835841
description:
2025-02-06 01:32:16 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:34630: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 01:31:36 ait sshd[908341]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Feb  6 01:31:41 ait sshd[908349]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Feb  6 01:31:41 ait sshd[908349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
country_id: 617790
description:
2025-02-06 01:32:03 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:34366: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 01:31:36 ait sshd[908341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
country_id: 1835841
description:
Feb  6 01:32:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.68.11.223
country_id: 3017382
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-32.51.68.11.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.2
country_id: 617790
description:
Feb  6 01:32:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2025-02-06 01:32:11 dovecot_plain authenticator failed for (aulaul) [65.20.233.110]:40931: 535 Incorrect authentication data (set_id=ads22b22265y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.13.66
country_id: 3658394
description:
[2025-02-06 01:31:58 +0100] info [webmaild] 45.70.13.66 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.74.62
country_id: 3469034
description:
[2025-02-06 01:32:30 +0100] info [webmaild] 45.175.74.62 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
country_id: 1814991
description:
Feb  6 01:32:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
country_id: 3469034
description:
Feb  6 01:33:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.46.114
country_id: 1269750
description:
2025-02-06 01:32:45 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:60902: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.218.133.106
country_id: 1269750
description:
Feb  6 01:33:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.218.133.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.62
country_id: 1814991
description:
Feb  6 01:33:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.62
country_id: 1814991
description:
2025-02-06 01:33:18 dovecot_plain authenticator failed for ([125.90.72.62]) [125.90.72.62]:51872: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.113.61.126
country_id: 298795
description:
Feb  6 01:32:32 ait sshd[908631]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.113.61.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.20.46.114
country_id: 1269750
description:
Feb  6 01:32:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.20.46.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
country_id: 1814991
description:
2025-02-06 01:32:57 dovecot_plain authenticator failed for ([60.214.127.246]) [60.214.127.246]:30193: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.133.106
country_id: 1269750
description:
2025-02-06 01:33:02 dovecot_plain authenticator failed for ([103.218.133.106]) [103.218.133.106]:52812: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
country_id: 3469034
description:
2025-02-06 01:33:12 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:40370: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.113.61.126
country_id: 298795
description:
Feb  6 01:32:32 ait sshd[908631]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.113.61.126  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.94.253
country_id: 1210997
description:
[2025-02-06 01:33:34 +0100] info [webmaild] 182.48.94.253 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.240.58.132
country_id: 2017370
description:
2025-02-06 01:33:34 dovecot_plain authenticator failed for broadband-87-240-58-132.ip.moscow.rt.ru [87.240.58.132]:58190: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
country_id: 1814991
description:
Feb  6 01:33:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
country_id: 1814991
description:
Feb  6 01:33:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
country_id: 3895114
description:
Feb  6 01:33:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.240.58.132
country_id: 2017370
description:
Feb  6 01:33:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.240.58.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.183.83.64
country_id: 3469034
description:
[2025-02-06 01:34:09 +0100] info [webmaild] 200.183.83.64 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
country_id: 1814991
description:
2025-02-06 01:33:48 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:35026: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.165.170.41
country_id: 3895114
description:
2025-02-06 01:33:33 dovecot_plain authenticator failed for ([45.165.170.41]) [45.165.170.41]:51163: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
country_id: 1814991
description:
2025-02-06 01:33:48 dovecot_plain authenticator failed for ([180.104.103.146]) [180.104.103.146]:52466: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.232.91.22
country_id: 3996063
description:
[2025-02-06 01:34:29 +0100] info [webmaild] 177.232.91.22 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
country_id: 2017370
description:
Feb  6 01:35:12 ait sshd[909634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.170.250.140
country_id: 3469034
description:
[2025-02-06 01:34:59 +0100] info [webmaild] 177.170.250.140 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.57.221
country_id: 1880251
description:
47.128.57.221 - - [06/Feb/2025:01:34:32 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8265216 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/15d92b?panel=translation" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.57.221


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
country_id: 2017370
description:
Feb  6 01:35:12 ait sshd[909634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.234
country_id: 1814991
description:
2025-02-06 01:36:16 dovecot_plain authenticator failed for ([61.185.226.234]) [61.185.226.234]:46680: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.137.34.110
country_id: 1814991
description:
Feb  6 01:36:21 ait sshd[909938]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.137.34.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-06 01:35:51 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:47594: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 01:35:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.224.116
country_id: 3469034
description:
[2025-02-06 01:36:01 +0100] info [webmaild] 177.55.224.116 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 01:35:50 ait sshd[909870]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
country_id: 3469034
description:
Feb  6 01:36:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
country_id: 3469034
description:
2025-02-06 01:36:21 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:43185: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.137.34.110
country_id: 1814991
description:
Feb  6 01:36:21 ait sshd[909938]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.137.34.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
country_id: 1835841
description:
Feb  6 01:35:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.234
country_id: 1814991
description:
Feb  6 01:36:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 01:35:50 ait sshd[909870]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
country_id: 1668284
description:
Feb  6 01:36:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
country_id: 1668284
description:
2025-02-06 01:36:06 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:33220: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 01:36:34 ait sshd[910000]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
country_id: 1835841
description:
2025-02-06 01:36:42 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:56212: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.102.11
country_id: 1814991
description:
Feb  6 01:36:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.102.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.177.174.53
country_id: 3658394
description:
[2025-02-06 01:37:01 +0100] info [webmaild] 102.177.174.53 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 01:37:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
country_id: 1835841
description:
Feb  6 01:36:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 130.0.28.156
country_id: 783754
description:
[2025-02-06 01:36:35 +0100] info [webmaild] 130.0.28.156 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
country_id: 1814991
description:
2025-02-06 01:37:11 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:53268: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 01:37:24 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:41492: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
country_id: 6252001
description:
Feb  6 01:36:34 ait sshd[910000]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
country_id: 1814991
description:
2025-02-06 01:36:30 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:30136: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
country_id: 1814991
description:
Feb  6 01:37:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.185.194
country_id: 3469034
description:
[2025-02-06 01:37:31 +0100] info [webmaild] 45.188.185.194 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
country_id: 6252001
description:
2025-02-06 01:38:55 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:45262: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
country_id: 1814991
description:
Feb  6 01:38:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.129.26
country_id: 1880251
description:
Feb  6 01:39:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.129.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
country_id: 1814991
description:
Feb  6 01:39:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
country_id: 1814991
description:
2025-02-06 01:39:06 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:48164: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
country_id: 1835841
description:
Feb  6 01:39:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
country_id: 2264397
description:
2025-02-06 01:38:53 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:43522: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
country_id: 1814991
description:
2025-02-06 01:39:16 dovecot_plain authenticator failed for ([222.175.110.3]) [222.175.110.3]:57314: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
country_id: 1814991
description:
Feb  6 01:39:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.61.95
country_id: 2661886
description:
Feb  6 01:38:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.61.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.129.26
country_id: 1880251
description:
2025-02-06 01:39:05 dovecot_plain authenticator failed for bb115-66-129-26.singnet.com.sg [115.66.129.26]:58830: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
country_id: 2264397
description:
Feb  6 01:38:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
country_id: 1814991
description:
2025-02-06 01:39:00 dovecot_plain authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:44524: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-02-06 01:38:51 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:34903: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
country_id: 6252001
description:
Feb  6 01:38:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
country_id: 1814991
description:
2025-02-06 01:38:53 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:52160: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
country_id: 1168579
description:
2025-02-06 01:39:10 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:36644: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.61.95
country_id: 2661886
description:
2025-02-06 01:38:58 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:50887: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
country_id: 1168579
description:
Feb  6 01:39:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
country_id: 290557
description:
2025-02-06 01:38:48 dovecot_plain authenticator failed for ([94.200.95.18]) [94.200.95.18]:43482: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.153.85.153
country_id: 3625428
description:
[2025-02-06 01:39:08 +0100] info [webmaild] 190.153.85.153 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.95.18
country_id: 290557
description:
Feb  6 01:38:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.95.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
country_id: 1880251
description:
Feb  6 01:38:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-02-06 01:39:08 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:56294: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
country_id: 1880251
description:
Feb  6 01:38:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
country_id: 1814991
description:
Feb  6 01:38:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
country_id: 1880251
description:
2025-02-06 01:38:58 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:39002: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
country_id: 1562822
description:
Feb  6 01:39:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
country_id: 1562822
description:
2025-02-06 01:39:11 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:17433: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.136.72
country_id: 3469034
description:
[2025-02-06 01:38:34 +0100] info [webmaild] 177.67.136.72 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 01:40:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.54
country_id: 1814991
description:
Feb  6 01:40:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.150.37.249
country_id: 2017370
description:
Feb  6 01:40:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.150.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.54
country_id: 1814991
description:
2025-02-06 01:40:26 dovecot_plain authenticator failed for ([157.122.198.54]) [157.122.198.54]:38726: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
country_id: 3895114
description:
Feb  6 01:40:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
country_id: 798544
description:
2025-02-06 01:40:14 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:48378: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-02-06 01:40:16 dovecot_plain authenticator failed for ([196.189.124.229]) [196.189.124.229]:39632: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
country_id: 6252001
description:
Feb  6 01:40:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.24.210.27
country_id: 1814991
description:
Feb  6 01:40:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.24.210.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
country_id: 1814991
description:
Feb  6 01:40:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
country_id: 2017370
description:
2025-02-06 01:40:25 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:51822: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
country_id: 1819730
description:
2025-02-06 01:40:28 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:42658: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.173.45.180
country_id: 2017370
description:
Feb  6 01:40:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.173.45.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.173.45.180
country_id: 2017370
description:
2025-02-06 01:40:14 dovecot_plain authenticator failed for ([46.173.45.180]) [46.173.45.180]:55114: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
country_id: 6252001
description:
2025-02-06 01:40:17 dovecot_plain authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:35014: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
country_id: 1269750
description:
2025-02-06 01:40:18 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:43268: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
country_id: 1835841
description:
2025-02-06 01:40:18 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:57118: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 01:40:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.69.46.148
country_id: 1168579
description:
Feb  6 01:40:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.69.46.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
country_id: 1269750
description:
2025-02-06 01:40:14 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:41718: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
country_id: 1210997
description:
2025-02-06 01:40:15 dovecot_plain authenticator failed for ([103.65.227.72]) [114.130.181.74]:39748: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 01:40:23 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:43909: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.185.13.59
country_id: 1835841
description:
Feb  6 01:40:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.185.13.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
country_id: 1819730
description:
Feb  6 01:40:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.205.83
country_id: 1835841
description:
2025-02-06 01:40:19 dovecot_plain authenticator failed for ([112.164.205.83]) [112.164.205.83]:49557: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2025-02-06 01:40:27 dovecot_plain authenticator failed for ([203.192.247.84]) [203.192.247.84]:43990: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  6 01:40:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.69.46.148
country_id: 1168579
description:
2025-02-06 01:40:15 dovecot_plain authenticator failed for ([202.69.46.148]) [202.69.46.148]:47809: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
country_id: 1814991
description:
Feb  6 01:40:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.205.83
country_id: 1835841
description:
Feb  6 01:40:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.205.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
country_id: 6252001
description:
2025-02-06 01:40:17 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:35616: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
country_id: 6252001
description:
Feb  6 01:40:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.9.65.38
country_id: 3469034
description:
[2025-02-06 01:40:08 +0100] info [webmaild] 190.9.65.38 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
country_id: 1835841
description:
Feb  6 01:40:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.59.184
country_id: 6252001
description:
2025-02-06 01:40:17 dovecot_plain authenticator failed for 184.sub-166-143-59.myvzw.com [166.143.59.184]:35999: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
country_id: 2017370
description:
Feb  6 01:40:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-06 01:40:25 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:49921: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
country_id: 1835841
description:
Feb  6 01:40:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.136.3.132
country_id: 1210997
description:
[2025-02-06 01:39:38 +0100] info [webmaild] 103.136.3.132 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
country_id: 6252001
description:
Feb  6 01:40:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 01:40:15 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:46389: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2025-02-06 01:40:16 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:54471: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
country_id: 1269750
description:
Feb  6 01:40:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.241
country_id: 6252001
description:
2025-02-06 01:40:19 dovecot_plain authenticator failed for (mobile-166-195-196-241.mycingular.net) [166.195.196.241]:38042: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
country_id: 690791
description:
2025-02-06 01:40:14 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:54878: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  6 01:40:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
country_id: 102358
description:
2025-02-06 01:40:15 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:44106: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
country_id: 3469034
description:
2025-02-06 01:40:16 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:59494: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
country_id: 6252001
description:
2025-02-06 01:40:26 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:53321: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
country_id: 1668284
description:
Feb  6 01:40:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.180.193.176
country_id: 6252001
description:
Feb  6 01:40:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.180.193.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-02-06 01:40:14 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:54162: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
country_id: 1269750
description:
Feb  6 01:40:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
country_id: 337996
description:
Feb  6 01:40:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-06 01:40:16 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:42117: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.214.226
country_id: 1269750
description:
Feb  6 01:40:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
country_id: 2245662
description:
Feb  6 01:40:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
country_id: 690791
description:
Feb  6 01:40:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
country_id: 1814991
description:
Feb  6 01:40:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
country_id: 1814991
description:
2025-02-06 01:40:18 dovecot_plain authenticator failed for ([1.24.210.27]) [1.24.210.27]:54520: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
country_id: 3469034
description:
2025-02-06 01:40:17 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:52533: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-06 01:40:19 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:42724: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
country_id: 6252001
description:
2025-02-06 01:40:25 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:60317: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
country_id: 1269750
description:
2025-02-06 01:40:16 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:41498: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.247.84
country_id: 1269750
description:
Feb  6 01:40:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.247.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
country_id: 3469034
description:
2025-02-06 01:40:26 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:34994: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.143.165
country_id: 2017370
description:
Feb  6 01:40:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.143.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.150.37.249
country_id: 2017370
description:
2025-02-06 01:40:28 dovecot_plain authenticator failed for ([217.150.37.249]) [217.150.37.249]:60548: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
country_id: 3469034
description:
Feb  6 01:40:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.241
country_id: 6252001
description:
Feb  6 01:40:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
country_id: 1814991
description:
2025-02-06 01:40:18 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:21068: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
country_id: 1819730
description:
2025-02-06 01:40:20 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:45903: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
country_id: 6252001
description:
Feb  6 01:40:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
country_id: 1814991
description:
2025-02-06 01:40:23 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:51370: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 01:40:28 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:41896: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.70.129.101
country_id: 6252001
description:
Feb  6 01:40:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.70.129.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.185.13.59
country_id: 1835841
description:
2025-02-06 01:40:26 dovecot_plain authenticator failed for ([211.185.13.59]) [211.185.13.59]:39812: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
country_id: 798544
description:
Feb  6 01:40:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
country_id: 1269750
description:
Feb  6 01:40:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
country_id: 1210997
description:
Feb  6 01:40:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
country_id: 3017382
description:
2025-02-06 01:40:14 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:37186: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
country_id: 3469034
description:
Feb  6 01:40:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-40.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.180.193.176
country_id: 6252001
description:
2025-02-06 01:40:28 dovecot_plain authenticator failed for wsip-184-180-193-176.tu.ok.cox.net [184.180.193.176]:56970: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
country_id: 3923057
description:
2025-02-06 01:40:28 dovecot_plain authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:59550: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Feb  6 01:40:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
country_id: 102358
description:
Feb  6 01:40:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
country_id: 1819730
description:
Feb  6 01:40:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
country_id: 3923057
description:
Feb  6 01:40:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.214.226
country_id: 1269750
description:
2025-02-06 01:40:18 dovecot_plain authenticator failed for (broadband.actcorp.in) [115.245.214.226]:33112: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
country_id: 6252001
description:
2025-02-06 01:40:21 dovecot_login authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:62758: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
country_id: 1269750
description:
Feb  6 01:40:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.119.20.149
country_id: 1835841
description:
Feb  6 01:40:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.119.20.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
country_id: 3895114
description:
2025-02-06 01:40:28 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:38762: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
country_id: 1668284
description:
2025-02-06 01:40:25 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:55347: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
country_id: 1819730
description:
2025-02-06 01:40:26 dovecot_plain authenticator failed for ([121.202.200.120]) [121.202.200.120]:37952: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
country_id: 3017382
description:
Feb  6 01:40:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
country_id: 6252001
description:
Feb  6 01:40:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.143.59.184
country_id: 6252001
description:
Feb  6 01:40:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.143.59.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
country_id: 3469034
description:
Feb  6 01:40:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
country_id: 1819730
description:
Feb  6 01:40:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
country_id: 2245662
description:
2025-02-06 01:40:25 dovecot_plain authenticator failed for ([154.65.33.26]) [196.207.241.168]:44794: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.118.248
country_id: 1814991
description:
Feb  6 01:40:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.118.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
country_id: 1835841
description:
2025-02-06 01:40:27 dovecot_login authenticator failed for ([175.117.144.158]) [175.117.144.158]:54640: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
country_id: 1880251
description:
Feb  6 01:40:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
country_id: 3144096
description:
2025-02-06 01:40:35 dovecot_plain authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:60300: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  6 01:40:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
country_id: 1668284
description:
2025-02-06 01:40:40 dovecot_login authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:42886: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
country_id: 1814991
description:
2025-02-06 01:40:41 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:26474: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.66.113.58
country_id: 1814991
description:
2025-02-06 01:40:44 dovecot_plain authenticator failed for ([183.66.113.58]) [183.66.113.58]:45318: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.118.248
country_id: 1814991
description:
2025-02-06 01:40:29 dovecot_plain authenticator failed for ([183.6.118.248]) [183.6.118.248]:40970: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  6 01:40:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
country_id: 6252001
description:
Feb  6 01:41:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
country_id: 1835841
description:
Feb  6 01:40:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
country_id: 3469034
description:
Feb  6 01:40:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
country_id: 2017370
description:
Feb  6 01:40:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
country_id: 1835841
description:
Feb  6 01:40:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
country_id: 732800
description:
Feb  6 01:40:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
country_id: 1819730
description:
2025-02-06 01:40:52 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:55543: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
country_id: 1819730
description:
Feb  6 01:40:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
country_id: 2287781
description:
Feb  6 01:40:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-02-06 01:41:05 dovecot_plain authenticator failed for ([170.233.29.157]) [170.233.29.157]:50147: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
country_id: 2921044
description:
Feb  6 01:41:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
country_id: 2017370
description:
Feb  6 01:40:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
country_id: 1835841
description:
2025-02-06 01:40:45 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:41780: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.138.238
country_id: 3469034
description:
[2025-02-06 01:41:10 +0100] info [webmaild] 186.249.138.238 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
country_id: 2921044
description:
2025-02-06 01:41:25 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (mamtracia) [91.56.31.167]:64755: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-02-06 01:40:34 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:34360: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
country_id: 3017382
description:
2025-02-06 01:40:35 dovecot_plain authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:51460: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
country_id: 1668284
description:
Feb  6 01:40:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
country_id: 1819730
description:
2025-02-06 01:40:51 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:52437: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.174.136
country_id: 1814991
description:
Feb  6 01:40:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.174.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-06 01:40:32 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:50491: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.200.95.200
country_id: 2750405
description:
2025-02-06 01:40:37 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:55799: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Feb  6 01:40:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
country_id: 1814991
description:
Feb  6 01:40:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
country_id: 6252001
description:
2025-02-06 01:40:45 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:45793: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
country_id: 1814991
description:
Feb  6 01:40:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
country_id: 1814991
description:
2025-02-06 01:40:30 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:38906: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
country_id: 1819730
description:
2025-02-06 01:40:33 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:48288: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-02-06 01:41:27 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:54704: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
country_id: 1814991
description:
2025-02-06 01:40:30 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:35550: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  6 01:40:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
country_id: 2017370
description:
2025-02-06 01:40:29 dovecot_plain authenticator failed for ([92.124.143.165]) [92.124.143.165]:51261: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
country_id: 1814991
description:
2025-02-06 01:40:31 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:33575: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
country_id: 1269750
description:
Feb  6 01:40:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 01:40:40 dovecot_plain authenticator failed for (host-80-241-253-238.customer.magticom.ge) [2.57.219.2]:48282: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 01:40:48 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:38980: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
country_id: 3996063
description:
2025-02-06 01:40:50 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:47907: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
country_id: 1269750
description:
Feb  6 01:40:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
country_id: 1814991
description:
Feb  6 01:40:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
country_id: 1814991
description:
2025-02-06 01:40:43 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:54526: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
country_id: 732800
description:
2025-02-06 01:40:50 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:43618: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
country_id: 6252001
description:
2025-02-06 01:40:29 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:36710: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
country_id: 3017382
description:
Feb  6 01:40:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-02-06 01:40:37 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:37949: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-06 01:40:39 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:39837: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
country_id: 1835841
description:
Feb  6 01:40:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
country_id: 1819730
description:
Feb  6 01:40:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
country_id: 1819730
description:
Feb  6 01:40:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
country_id: 6252001
description:
Feb  6 01:41:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
country_id: 1819730
description:
2025-02-06 01:40:31 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:17282: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.161.138.244
country_id: 3144096
description:
Feb  6 01:40:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.161.138.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
country_id: 1814991
description:
2025-02-06 01:40:45 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:53048: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.174.209.160
country_id: 1814991
description:
2025-02-06 01:40:40 dovecot_plain authenticator failed for ([220.174.209.156]) [220.174.209.160]:58021: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.66.113.58
country_id: 1814991
description:
Feb  6 01:40:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.66.113.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
country_id: 3469034
description:
2025-02-06 01:40:34 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:57076: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
country_id: 1814991
description:
Feb  6 01:40:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2025-02-06 01:40:44 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:34922: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  6 01:40:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
country_id: 1668284
description:
Feb  6 01:41:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
country_id: 1814991
description:
Feb  6 01:40:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Feb  6 01:40:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
country_id: 1269750
description:
2025-02-06 01:40:30 dovecot_login authenticator failed for ([103.69.9.250]) [103.69.9.250]:34005: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.174.136
country_id: 1814991
description:
2025-02-06 01:40:30 dovecot_plain authenticator failed for ([117.159.174.136]) [117.159.174.136]:48568: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
country_id: 1269750
description:
Feb  6 01:40:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.22.130.22
country_id: 1814991
description:
2025-02-06 01:40:31 dovecot_plain authenticator failed for ([210.22.130.22]) [210.22.130.22]:33259: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
country_id: 2287781
description:
2025-02-06 01:40:31 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:59324: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
country_id: 1814991
description:
Feb  6 01:40:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
country_id: 1814991
description:
Feb  6 01:40:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.119.20.149
country_id: 1835841
description:
2025-02-06 01:40:29 dovecot_plain authenticator failed for ([175.119.20.149]) [175.119.20.149]:40469: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.121.191.197
country_id: 1605651
description:
Feb  6 01:40:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.121.191.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
country_id: 294640
description:
Feb  6 01:41:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.142.14
country_id: 1814991
description:
Feb  6 01:40:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.142.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-06 01:40:56 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:57182: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
country_id: 1835841
description:
2025-02-06 01:40:42 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:52712: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
country_id: 6252001
description:
Feb  6 01:40:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
country_id: 3996063
description:
Feb  6 01:40:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.29.157
country_id: 3865483
description:
Feb  6 01:41:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.29.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
country_id: 2017370
description:
2025-02-06 01:40:38 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:52106: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
country_id: 2017370
description:
2025-02-06 01:40:41 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:50462: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.121.191.197
country_id: 1605651
description:
2025-02-06 01:41:00 dovecot_login authenticator failed for ppp-124-121-191-197.revip2.asianet.co.th [124.121.191.197]:33428: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
country_id: 1668284
description:
2025-02-06 01:41:12 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:49908: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
country_id: 1835841
description:
2025-02-06 01:40:33 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:37648: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.200.95.200
country_id: 2750405
description:
Feb  6 01:40:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.200.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
country_id: 1269750
description:
2025-02-06 01:40:36 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:35452: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.174.209.160
country_id: 1814991
description:
Feb  6 01:40:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.174.209.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
country_id: 1835841
description:
Feb  6 01:40:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
country_id: 6252001
description:
2025-02-06 01:41:02 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:57172: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.22.130.22
country_id: 1814991
description:
Feb  6 01:40:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.22.130.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
country_id: 1819730
description:
Feb  6 01:40:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
country_id: 294640
description:
2025-02-06 01:41:23 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:61147: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
country_id: 1269750
description:
2025-02-06 01:40:32 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:34314: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.142.14
country_id: 1814991
description:
2025-02-06 01:40:56 dovecot_plain authenticator failed for ([39.164.142.14]) [39.164.142.14]:28335: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
country_id: 6251999
description:
Feb  6 01:41:42 ait sshd[911796]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.103.31.156
country_id: 3625428
description:
[2025-02-06 01:41:54 +0100] info [webmaild] 190.103.31.156 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.47.5
country_id: 3469034
description:
[2025-02-06 01:41:57 +0100] info [webmaild] 138.59.47.5 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.108.17.107
country_id: 3439705
description:
[2025-02-06 01:42:16 +0100] info [webmaild] 190.108.17.107 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
country_id: 3469034
description:
Feb  6 01:41:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
country_id: 3469034
description:
2025-02-06 01:41:39 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:58130: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
country_id: 6251999
description:
Feb  6 01:41:42 ait sshd[911796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 01:42:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.228
country_id: 1814991
description:
Feb  6 01:42:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.228
country_id: 1814991
description:
2025-02-06 01:42:22 dovecot_plain authenticator failed for ([113.64.208.228]) [113.64.208.228]:57158: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.201.58
country_id: 1814991
description:
Feb  6 01:42:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 01:42:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.201.58
country_id: 1814991
description:
2025-02-06 01:42:35 dovecot_plain authenticator failed for ([220.178.201.58]) [220.178.201.58]:47786: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.175.51
country_id: 3469034
description:
[2025-02-06 01:42:41 +0100] info [webmaild] 186.194.175.51 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.196.221.74
country_id: 2077456
description:
2025-02-06 01:43:15 dovecot_plain authenticator failed for ([159.196.221.74]) [159.196.221.74]:3027: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 01:42:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.196.221.74
country_id: 2077456
description:
Feb  6 01:43:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.196.221.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.20
country_id: 3625428
description:
Feb  6 01:43:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.20
country_id: 3625428
description:
2025-02-06 01:43:25 dovecot_plain authenticator failed for (201.218.181.20.viptel.com) [201.218.181.20]:60414: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
country_id: 1814991
description:
2025-02-06 01:43:54 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:40154: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2025-02-06 01:44:07 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:38144: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
country_id: 6252001
description:
Feb  6 01:44:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.69.75
country_id: 1814991
description:
Feb  6 01:44:23 ait sshd[912423]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.69.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
country_id: 6252001
description:
2025-02-06 01:44:25 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:37966: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
country_id: 3469034
description:
2025-02-06 01:44:21 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:48075: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  6 01:44:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 01:44:22 ait sshd[912428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.69.75
country_id: 1814991
description:
Feb  6 01:44:23 ait sshd[912423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.69.75  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
country_id: 149590
description:
2025-02-06 01:43:49 dovecot_plain authenticator failed for ([41.93.113.138]) [41.93.113.138]:54938: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
country_id: 3017382
description:
2025-02-06 01:44:13 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:35226: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
country_id: 3469034
description:
Feb  6 01:44:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 01:44:22 ait sshd[912428]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.123.175.194
country_id: 1814991
description:
Feb  6 01:44:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.123.175.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
country_id: 3017382
description:
Feb  6 01:44:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.60.159.113
country_id: 3469034
description:
[2025-02-06 01:44:23 +0100] info [webmaild] 189.60.159.113 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.88.72
country_id: 6252001
description:
Feb  6 01:44:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.180.88.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
country_id: 1814991
description:
Feb  6 01:43:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
country_id: 6252001
description:
Feb  6 01:44:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-06 01:44:09 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:49746: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  6 01:44:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-06 01:44:24 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (jarylivirs) [109.67.154.24]:50924: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.167.215
country_id: 3469034
description:
[2025-02-06 01:43:47 +0100] info [webmaild] 177.131.167.215 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.175.194
country_id: 1814991
description:
2025-02-06 01:44:02 dovecot_plain authenticator failed for ([183.56.179.201]) [119.123.175.194]:50674: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
country_id: 337996
description:
Feb  6 01:44:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
country_id: 6252001
description:
2025-02-06 01:44:08 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:37534: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
country_id: 6252001
description:
2025-02-06 01:44:12 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:46978: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
country_id: 6252001
description:
Feb  6 01:44:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
country_id: 149590
description:
Feb  6 01:43:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 01:44:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
country_id: 1814991
description:
Feb  6 01:45:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.233.51
country_id: 3469034
description:
[2025-02-06 01:45:16 +0100] info [webmaild] 177.87.233.51 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.76.161.99
country_id: 289688
description:
Feb  6 01:44:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.76.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.180.88.72
country_id: 6252001
description:
2025-02-06 01:44:30 dovecot_plain authenticator failed for static-47-180-88-72.lsan.ca.frontiernet.net ([65.255.196.42]) [47.180.88.72]:35224: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.69.75
country_id: 1814991
description:
Feb  6 01:44:31 ait sshd[912442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.69.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.69.75
country_id: 1814991
description:
Feb  6 01:44:31 ait sshd[912442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.69.75  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.76.161.99
country_id: 289688
description:
2025-02-06 01:44:31 dovecot_plain authenticator failed for ([89.211.42.163]) [80.76.161.99]:14927: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.231.70.17
country_id: 3658394
description:
[2025-02-06 01:44:46 +0100] info [webmaild] 66.231.70.17 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
country_id: 1814991
description:
2025-02-06 01:45:12 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:58340: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
country_id: 6252001
description:
2025-02-06 01:46:03 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:51531: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-06 01:46:03 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:37386: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2025-02-06 01:46:22 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:36075: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
country_id: 2077456
description:
Feb  6 01:46:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
country_id: 6252001
description:
Feb  6 01:46:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.114.164
country_id: 3469034
description:
[2025-02-06 01:46:22 +0100] info [webmaild] 177.137.114.164 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
country_id: 2077456
description:
2025-02-06 01:46:27 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:59634: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 01:45:29 ait sshd[912990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.180.128.138
country_id: 1835841
description:
Feb  6 01:45:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.180.128.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  6 01:46:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
country_id: 6252001
description:
Feb  6 01:46:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.243.136.120
country_id: 1814991
description:
2025-02-06 01:46:14 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:43127: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
country_id: 6252001
description:
Feb  6 01:46:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
country_id: 3469034
description:
2025-02-06 01:46:04 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:51136: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
country_id: 1835841
description:
Feb  6 01:46:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
country_id: 294640
description:
Feb  6 01:45:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
country_id: 6252001
description:
2025-02-06 01:46:03 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:39560: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.243.136.120
country_id: 1814991
description:
Feb  6 01:46:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.243.136.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.247.249.10
country_id: 1269750
description:
Feb  6 01:45:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.247.249.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 01:45:29 ait sshd[912990]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 01:45:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.247.249.10
country_id: 1269750
description:
2025-02-06 01:45:30 dovecot_login authenticator failed for ([61.247.249.10]) [61.247.249.10]:47438: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.180.128.138
country_id: 1835841
description:
2025-02-06 01:45:52 dovecot_plain authenticator failed for ([211.180.128.138]) [211.180.128.138]:40686: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2025-02-06 01:45:55 dovecot_login authenticator failed for ([85.159.164.28]) [85.159.164.28]:42334: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
country_id: 3469034
description:
Feb  6 01:46:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-02-06 01:46:03 dovecot_login authenticator failed for (c-50-171-64-170.unallocated.comcastbusiness.net) [50.171.64.170]:53156: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.172.61.145
country_id: 1814991
description:
2025-02-06 01:47:23 dovecot_plain authenticator failed for ([39.172.61.145]) [39.172.61.145]:32818: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 01:47:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
country_id: 1814991
description:
2025-02-06 01:46:59 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:37567: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.183
country_id: 3277605
description:
Feb  6 01:47:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.183 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.139.140
country_id: 3469034
description:
[2025-02-06 01:47:06 +0100] info [webmaild] 186.224.139.140 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
country_id: 3277605
description:
2025-02-06 01:47:07 dovecot_plain authenticator failed for ([195.222.57.183]) [195.222.57.183]:46168: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.138.183
country_id: 3658394
description:
[2025-02-06 01:47:19 +0100] info [webmaild] 157.100.138.183 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.172.61.145
country_id: 1814991
description:
Feb  6 01:47:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.172.61.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  6 01:46:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-02-06 01:46:44 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:37680: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
country_id: 1814991
description:
Feb  6 01:46:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-06 01:47:50 dovecot_login authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:57057: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.148.191
country_id: 2661886
description:
Feb  6 01:47:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.148.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.148.191
country_id: 2661886
description:
2025-02-06 01:47:53 dovecot_plain authenticator failed for c188-148-148-191.bredband.tele2.se (yering) [188.148.148.191]:33350: 535 Incorrect authentication data (set_id=onajah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
country_id: 6252001
description:
Feb  6 01:48:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-02-06 01:48:08 dovecot_login authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:47895: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
country_id: 3865483
description:
Feb  6 01:47:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.184.227
country_id: 3469034
description:
[2025-02-06 01:47:50 +0100] info [webmaild] 138.97.184.227 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
country_id: 1835841
description:
2025-02-06 01:48:59 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:41272: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
country_id: 3469034
description:
Feb  6 01:49:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
country_id: 3469034
description:
2025-02-06 01:49:21 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:42161: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.6.56.226
country_id: 3469034
description:
2025-02-06 01:48:53 dovecot_plain authenticator failed for ([187.6.56.226]) [187.6.56.226]:56413: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
country_id: 1835841
description:
Feb  6 01:48:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.18.246
country_id: 1668284
description:
Feb  6 01:49:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.18.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.18.246
country_id: 1668284
description:
2025-02-06 01:49:05 dovecot_plain authenticator failed for 111-70-18-246.emome-ip.hinet.net [111.70.18.246]:57290: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.6.56.226
country_id: 3469034
description:
Feb  6 01:48:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.6.56.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.39.44.225
country_id: 3469034
description:
[2025-02-06 01:48:58 +0100] info [webmaild] 200.39.44.225 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 01:50:28 ait sshd[914456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.189.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.142.171.216
country_id: 3625428
description:
[2025-02-06 01:49:34 +0100] info [webmaild] 190.142.171.216 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.158.82.217
country_id: 2017370
description:
[2025-02-06 01:49:46 +0100] info [webmaild] 46.158.82.217 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.77.118
country_id: 1814991
description:
2025-02-06 01:49:45 dovecot_plain authenticator failed for ([122.227.77.118]) [122.227.77.118]:52981: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
country_id: 2017370
description:
Feb  6 01:49:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
country_id: 2017370
description:
2025-02-06 01:49:54 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:51306: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.234
country_id: 99237
description:
Feb  6 01:50:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.77.118
country_id: 1814991
description:
Feb  6 01:49:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.77.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.234
country_id: 99237
description:
2025-02-06 01:50:16 dovecot_plain authenticator failed for (sprast) [65.20.169.234]:40242: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.19.9
country_id: 3469034
description:
[2025-02-06 01:50:19 +0100] info [webmaild] 177.223.19.9 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 01:50:28 ait sshd[914456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-02-06 01:51:04 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:38440: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 01:51:08 ait sshd[914730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.149.139


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.189.72.148
country_id: 1819730
description:
Feb  6 01:50:30 ait sshd[914456]: Failed password for invalid user goudirect from 218.189.72.148 port 56538 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-06 01:50:54 dovecot_login authenticator failed for ([114.242.61.19]) [114.242.61.35]:35764: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
country_id: 3469034
description:
Feb  6 01:51:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
country_id: 99237
description:
Feb  6 01:51:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.205
country_id: 99237
description:
2025-02-06 01:51:15 dovecot_plain authenticator failed for (ingly) [65.20.155.205]:52464: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  6 01:50:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 01:51:08 ait sshd[914730]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.149.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.83.55.45
country_id: 3508796
description:
[2025-02-06 01:52:16 +0100] info [webmaild] 38.83.55.45 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.232.211.11
country_id: 3469034
description:
[2025-02-06 01:52:16 +0100] info [webmaild] 186.232.211.11 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.99.146.4
country_id: 102358
description:
Feb  6 01:51:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.99.146.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.200.144
country_id: 3469034
description:
[2025-02-06 01:51:38 +0100] info [webmaild] 45.168.200.144 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.146.4
country_id: 102358
description:
2025-02-06 01:51:38 dovecot_plain authenticator failed for (nonsting) [37.99.146.4]:61626: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
country_id: 3017382
description:
2025-02-06 01:53:09 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:33344: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
country_id: 6252001
description:
Feb  6 01:53:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
country_id: 6252001
description:
2025-02-06 01:53:21 dovecot_plain authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:63526: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.100.235.236
country_id: 1210997
description:
[2025-02-06 01:52:49 +0100] info [webmaild] 103.100.235.236 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
country_id: 3017382
description:
Feb  6 01:53:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.104.137.177
country_id: 2921044
description:
Feb  6 01:53:24 ait sshd[915293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.104.137.177  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
country_id: 192950
description:
2025-02-06 01:53:09 dovecot_login authenticator failed for ([102.215.188.37]) [102.215.188.37]:58245: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
country_id: 6252001
description:
Feb  6 01:53:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
country_id: 6252001
description:
2025-02-06 01:53:23 dovecot_login authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:49245: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
country_id: 192950
description:
Feb  6 01:53:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.104.137.177
country_id: 2921044
description:
Feb  6 01:53:24 ait sshd[915293]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.104.137.177 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 139.99.23.122
country_id: 1880251
domain: iric.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/2014/07/olx.php||SC:/home/titlemas/public_html/iric.us/wp-content/uploads/2014


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
country_id: 1269750
description:
Feb  6 01:53:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.31.172
country_id: 1562822
description:
Feb  6 01:54:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.31.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-02-06 01:53:41 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:45906: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
country_id: 1814991
description:
2025-02-06 01:53:53 dovecot_plain authenticator failed for ([36.110.161.134]) [36.110.161.134]:59502: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
country_id: 6252001
description:
Feb  6 01:54:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
country_id: 1562822
description:
2025-02-06 01:54:21 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:54276: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
country_id: 1814991
description:
Feb  6 01:53:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 01:53:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
country_id: 6252001
description:
2025-02-06 01:54:06 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:34086: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.168.230.167
country_id: 3351879
description:
[2025-02-06 01:54:17 +0100] info [webmaild] 105.168.230.167 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.99.23.122
country_id: 1880251
domain: iric.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:01-53.139.99.23.122||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.154.62
country_id: 2017370
description:
2025-02-06 01:54:51 dovecot_plain authenticator failed for broadband-5-228-154-62.ip.moscow.rt.ru (prosconan) [5.228.154.62]:39188: 535 Incorrect authentication data (set_id=mordzifa@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.71.82
country_id: 3469034
description:
[2025-02-06 01:54:55 +0100] info [webmaild] 170.245.71.82 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
country_id: 1269750
description:
Feb  6 01:55:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
country_id: 1814991
description:
2025-02-06 01:55:17 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:50258: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.240.129.68
country_id: 1814991
description:
Feb  6 01:54:29 ait sshd[915610]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.240.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.154.62
country_id: 2017370
description:
Feb  6 01:54:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
country_id: 1835841
description:
2025-02-06 01:54:56 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:38432: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.222.30.67
country_id: 6251999
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:01-54.51.222.30.67


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.45.16
country_id: 3469034
description:
[2025-02-06 01:54:53 +0100] info [webmaild] 186.233.45.16 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 01:54:54 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:39164: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.151.45.136
country_id: 1814991
description:
Feb  6 01:55:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.151.45.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
country_id: 1269750
description:
2025-02-06 01:55:08 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:27702: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.68.180
country_id: 2077456
description:
Feb  6 01:55:10 ait sshd[915948]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.68.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.68.180
country_id: 2077456
description:
Feb  6 01:55:10 ait sshd[915948]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.68.180


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.240.129.68
country_id: 1814991
description:
Feb  6 01:54:29 ait sshd[915610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.240.129.68  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.118
country_id: 226074
description:
Feb  6 01:55:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.46.115.102
country_id: 719819
description:
[2025-02-06 01:55:23 +0100] info [webmaild] 31.46.115.102 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
country_id: 1814991
description:
Feb  6 01:55:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
country_id: 1835841
description:
Feb  6 01:54:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-02-06 01:55:09 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:40347: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.89.118
country_id: 226074
description:
2025-02-06 01:55:22 dovecot_plain authenticator failed for ([196.0.89.118]) [196.0.89.118]:57768: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 01:54:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-06 01:55:33 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:34856: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
country_id: 6252001
description:
2025-02-06 01:55:33 dovecot_plain authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:50164: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
country_id: 1814991
description:
Feb  6 01:55:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.138.16.71
country_id: 798544
description:
2025-02-06 01:55:44 dovecot_login authenticator failed for (6dovvj6O) [45.138.16.71]:53457: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
country_id: 1814991
description:
Feb  6 01:55:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
country_id: 6251999
description:
Feb  6 01:55:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-06 01:56:00 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:63133: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Feb  6 01:56:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
country_id: 1835841
description:
Feb  6 01:56:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
country_id: 1835841
description:
2025-02-06 01:56:13 dovecot_plain authenticator failed for ([121.189.198.60]) [121.189.198.60]:59180: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
country_id: 2750405
description:
Feb  6 01:55:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
country_id: 3469034
description:
Feb  6 01:55:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
country_id: 1814991
description:
2025-02-06 01:55:34 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:56836: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.1.50
country_id: 1814991
description:
Feb  6 01:55:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.1.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  6 01:55:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-06 01:56:00 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:39846: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  6 01:55:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.1.50
country_id: 1814991
description:
2025-02-06 01:55:37 dovecot_plain authenticator failed for ([113.140.1.50]) [113.140.1.50]:56941: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.21.102.172
country_id: 1668284
description:
Feb  6 01:55:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.21.102.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.41.171
country_id: 1819730
description:
Feb  6 01:56:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.41.171
country_id: 1819730
description:
2025-02-06 01:56:09 dovecot_plain authenticator failed for 171.41.246.220.static.netvigator.com [220.246.41.171]:49243: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  6 01:55:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
country_id: 3469034
description:
Feb  6 01:55:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
country_id: 1835841
description:
2025-02-06 01:55:46 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:41012: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.214.147
country_id: 2750405
description:
2025-02-06 01:55:32 dovecot_plain authenticator failed for host-ys.srk1-b.v4.dfn.nl [62.238.214.147]:34566: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.67.43.194
country_id: 1814991
description:
2025-02-06 01:55:41 dovecot_plain authenticator failed for ([183.67.43.194]) [183.67.43.194]:60800: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
country_id: 1835841
description:
Feb  6 01:55:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
country_id: 2017370
description:
2025-02-06 01:55:46 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:19337: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
country_id: 149590
description:
Feb  6 01:55:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
country_id: 1814991
description:
2025-02-06 01:55:54 dovecot_plain authenticator failed for ([183.6.43.236]) [183.6.43.236]:36614: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-02-06 01:56:03 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:46586: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
country_id: 1269750
description:
2025-02-06 01:55:33 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:37142: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-06 01:55:40 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:33642: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
country_id: 1269750
description:
2025-02-06 01:55:41 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:53732: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
country_id: 1835841
description:
Feb  6 01:55:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-06 01:56:01 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:29279: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  6 01:55:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
country_id: 1819730
description:
Feb  6 01:55:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
country_id: 6251999
description:
2025-02-06 01:55:33 dovecot_plain authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:60166: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
country_id: 1819730
description:
2025-02-06 01:55:35 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:54091: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
country_id: 6252001
description:
2025-02-06 01:56:13 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:34547: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.10.124
country_id: 3017382
description:
Feb  6 01:56:26 ait sshd[916463]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.10.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
country_id: 6252001
description:
Feb  6 01:55:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
country_id: 3469034
description:
2025-02-06 01:55:34 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:45593: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.71
country_id: 798544
description:
Feb  6 01:55:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
country_id: 1814991
description:
Feb  6 01:55:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
country_id: 2017370
description:
Feb  6 01:56:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
country_id: 2750405
description:
2025-02-06 01:55:32 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:37776: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
country_id: 1269750
description:
Feb  6 01:55:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
country_id: 3469034
description:
2025-02-06 01:55:47 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:46586: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-06 01:55:54 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:43540: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 01:55:54 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:38233: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  6 01:55:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
country_id: 2017370
description:
2025-02-06 01:56:20 dovecot_plain authenticator failed for (stamare) [77.51.214.170]:49486: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.214.147
country_id: 2750405
description:
Feb  6 01:55:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.214.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
country_id: 1814991
description:
Feb  6 01:55:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.67.43.194
country_id: 1814991
description:
Feb  6 01:55:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.67.43.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
country_id: 149590
description:
2025-02-06 01:55:55 dovecot_plain authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:51364: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
country_id: 1814991
description:
2025-02-06 01:55:55 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:49085: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
country_id: 1668284
description:
2025-02-06 01:56:03 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:47126: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.102.172
country_id: 1668284
description:
2025-02-06 01:55:46 dovecot_plain authenticator failed for 211-21-102-172.hinet-ip.hinet.net [211.21.102.172]:51962: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
country_id: 6251999
description:
2025-02-06 01:55:58 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:60460: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
country_id: 1819730
description:
Feb  6 01:55:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
country_id: 732800
description:
2025-02-06 01:55:31 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:36800: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
country_id: 1835841
description:
Feb  6 01:55:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.147
country_id: 99237
description:
Feb  6 01:55:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-06 01:55:45 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:44038: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  6 01:55:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  6 01:55:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
country_id: 1819730
description:
2025-02-06 01:56:01 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:34048: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
country_id: 1668284
description:
Feb  6 01:56:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 01:56:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
country_id: 1269750
description:
Feb  6 01:55:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  6 01:55:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.10.124
country_id: 3017382
description:
Feb  6 01:56:26 ait sshd[916463]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.10.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
country_id: 732800
description:
Feb  6 01:55:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Feb  6 01:55:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-06 01:55:46 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:59833: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-06 01:55:35 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:39482: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-02-06 01:55:49 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:50966: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  6 01:55:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.174.189.52
country_id: 1835841
description:
Feb  6 01:56:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.174.189.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
country_id: 6252001
description:
Feb  6 01:56:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
country_id: 6251999
description:
Feb  6 01:55:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
country_id: 1835841
description:
2025-02-06 01:55:41 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:51382: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
country_id: 2017370
description:
Feb  6 01:55:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.147
country_id: 99237
description:
2025-02-06 01:55:45 dovecot_plain authenticator failed for (tates) [65.20.205.147]:43224: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-02-06 01:55:47 dovecot_plain authenticator failed for ([192.34.128.202]) [192.34.128.202]:44222: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.174.189.52
country_id: 1835841
description:
2025-02-06 01:56:13 dovecot_plain authenticator failed for ([121.174.189.52]) [121.174.189.52]:45450: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.10.124
country_id: 3017382
description:
Feb  6 01:56:29 ait sshd[916463]: Failed password for invalid user chenjun from 54.37.10.124 port 37812 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.138.16.71
country_id: 798544
description:
2025-02-06 01:56:38 dovecot_login authenticator failed for (NBUKhDU2uC) [45.138.16.71]:52885: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.251.239
country_id: 1835841
description:
Feb  6 01:56:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.251.239 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.254.110.36
country_id: 2017370
description:
[2025-02-06 01:56:55 +0100] info [webmaild] 188.254.110.36 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
country_id: 1814991
description:
2025-02-06 01:57:02 dovecot_login authenticator failed for ([222.216.2.74]) [222.216.2.74]:57166: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 01:57:04 ait sshd[916650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.71
country_id: 798544
description:
Feb  6 01:56:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.251.239
country_id: 1835841
description:
2025-02-06 01:56:50 dovecot_login authenticator failed for ([112.164.251.239]) [112.164.251.239]:37247: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
country_id: 1814991
description:
Feb  6 01:57:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 01:57:04 ait sshd[916650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.170.3
country_id: 3865483
description:
[2025-02-06 01:57:24 +0100] info [webmaild] 186.158.170.3 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.10.252.174
country_id: 1643084
description:
Feb  6 01:57:31 ait sshd[916723]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.10.252.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.215.34.114
country_id: 630336
description:
[2025-02-06 01:57:30 +0100] info [webmaild] 37.215.34.114 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
country_id: 1814991
description:
2025-02-06 01:58:11 dovecot_login authenticator failed for ([218.98.160.119]) [218.98.160.117]:14878: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.30.217.31
country_id: 2017370
description:
Feb  6 01:58:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.30.217.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.30.217.31
country_id: 2017370
description:
2025-02-06 01:58:19 dovecot_login authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:59350: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.10.252.174
country_id: 1643084
description:
Feb  6 01:57:31 ait sshd[916723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.10.252.174  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 210.1.246.60
country_id: 1210997
description:
[2025-02-06 01:57:55 +0100] info [webmaild] 210.1.246.60 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
country_id: 1814991
description:
Feb  6 01:58:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.10.124
country_id: 3017382
description:
Feb  6 01:59:06 ait sshd[917150]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.10.124 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.10.124
country_id: 3017382
description:
Feb  6 01:59:06 ait sshd[917150]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.10.124


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.37.10.124
country_id: 3017382
description:
Feb  6 02:00:12 ait sshd[917608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.10.124


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
country_id: 1835841
description:
Feb  6 02:00:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
country_id: 1835841
description:
2025-02-06 02:00:16 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:33618: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.96.133.206
country_id: 3469034
description:
[2025-02-06 02:00:21 +0100] info [webmaild] 179.96.133.206 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.30.3
country_id: 3469034
description:
[2025-02-06 02:00:23 +0100] info [webmaild] 45.234.30.3 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 54.37.10.124
country_id: 3017382
description:
Feb  6 02:00:14 ait sshd[917608]: Failed password for invalid user fernando from 54.37.10.124 port 44608 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.142.136
country_id: 3658394
description:
[2025-02-06 01:59:46 +0100] info [webmaild] 157.100.142.136 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.196.7.202
country_id: 1269750
description:
Feb  6 02:00:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.196.7.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.108.54.27
country_id: 3469034
description:
[2025-02-06 01:59:53 +0100] info [webmaild] 131.108.54.27 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.196.7.202
country_id: 1269750
description:
2025-02-06 02:00:02 dovecot_login authenticator failed for ([117.196.7.202]) [117.196.7.202]:57501: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.37.10.124
country_id: 3017382
description:
Feb  6 02:00:12 ait sshd[917608]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.37.10.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 02:00:28 ait sshd[917824]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.0.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 02:00:28 ait sshd[917824]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.0.30


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 02:01:21 ait sshd[918178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 02:00:33 ait sshd[917925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.88.29  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 02:01:21 ait sshd[918178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 02:00:33 ait sshd[917925]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.88.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.185.121
country_id: 99237
description:
Feb  6 02:01:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.185.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
country_id: 1835841
description:
2025-02-06 02:01:55 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:45003: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-02-06 02:02:14 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:43206: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.121
country_id: 99237
description:
2025-02-06 02:01:50 dovecot_plain authenticator failed for (manonpa) [65.20.185.121]:56940: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
country_id: 1835841
description:
Feb  6 02:01:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.235.158
country_id: 6252001
description:
Feb  6 02:02:18 ait sshd[918566]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.235.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.235.158
country_id: 6252001
description:
Feb  6 02:02:18 ait sshd[918566]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.235.158  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
country_id: 2661886
description:
Feb  6 02:02:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
country_id: 2661886
description:
2025-02-06 02:02:23 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:60880: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  6 02:02:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.216.174.223
country_id: 1269750
description:
2025-02-06 02:01:40 dovecot_login authenticator failed for ([117.216.174.223]) [117.216.174.223]:60547: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.175.120.25
country_id: 2782113
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:02-01.83.175.120.25


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 02:02:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.62.226
country_id: 1880251
description:
47.128.62.226 - - [06/Feb/2025:02:02:08 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25017174 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/soft-skills/?duration=short&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.226


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.173.52
country_id: 3469034
description:
[2025-02-06 02:02:28 +0100] info [webmaild] 177.22.173.52 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.27.87.155
country_id: 798549
description:
[2025-02-06 02:02:56 +0100] info [webmaild] 188.27.87.155 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.175.61.9
country_id: 1835841
description:
Feb  6 02:02:58 ait sshd[918627]: pam_imunify(sshd:auth): [IM360_RBL] The IP 112.175.61.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.175.61.9
country_id: 1835841
description:
Feb  6 02:02:58 ait sshd[918627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.175.61.9


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.44.223.206
country_id: 3469034
description:
[2025-02-06 02:02:29 +0100] info [webmaild] 187.44.223.206 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Feb  6 02:03:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.218.38
country_id: 3437598
description:
[2025-02-06 02:03:03 +0100] info [webmaild] 170.233.218.38 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-02-06 02:03:02 dovecot_plain authenticator failed for (prant) [102.53.15.17]:51449: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.51.223
country_id: 1880251
description:
47.128.51.223 - - [06/Feb/2025:02:03:17 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25946150 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=296&id=237&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.51.223


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.53
country_id: 2635167
description:
Feb  6 02:04:00 ait sshd[918903]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.53
country_id: 2635167
description:
Feb  6 02:04:00 ait sshd[918903]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.53  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.210.117.52
country_id: 3017382
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:02-03.51.210.117.52


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.159.0.211
country_id: 2233387
description:
Feb  6 02:04:55 ait sshd[919127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 197.159.0.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 197.159.0.211
country_id: 2233387
description:
Feb  6 02:04:55 ait sshd[919127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.159.0.211


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 02:05:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
country_id: 3017382
description:
2025-02-06 02:04:54 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (agere) [51.255.84.180]:48868: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.253.210.125
country_id: 587116
description:
[2025-02-06 02:05:06 +0100] info [webmaild] 188.253.210.125 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
country_id: 1269750
description:
Feb  6 02:04:47 ait sshd[919098]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 02:04:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
country_id: 3017382
description:
Feb  6 02:04:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.90.219.217
country_id: 1512440
description:
[2025-02-06 02:05:11 +0100] info [webmaild] 91.90.219.217 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 02:04:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
country_id: 1269750
description:
Feb  6 02:04:47 ait sshd[919098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
country_id: 298795
description:
Feb  6 02:05:47 ait sshd[919717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
country_id: 298795
description:
Feb  6 02:05:47 ait sshd[919717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 02:05:53 ait sshd[919725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.240.73.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.30.41
country_id: 3469034
description:
[2025-02-06 02:05:43 +0100] info [webmaild] 179.189.30.41 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 02:05:53 ait sshd[919725]: pam_imunify(sshd:auth): [IM360_RBL] The IP 4.240.73.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.192.44.166
country_id: 3469034
description:
[2025-02-06 02:05:34 +0100] info [webmaild] 186.192.44.166 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
country_id: 1562822
description:
Feb  6 02:07:13 ait sshd[920141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
country_id: 1819730
description:
2025-02-06 02:06:30 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:48136: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.60.82
country_id: 1814991
description:
Feb  6 02:06:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.60.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.60.82
country_id: 1814991
description:
2025-02-06 02:06:48 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:40830: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
country_id: 1562822
description:
Feb  6 02:07:13 ait sshd[920141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
country_id: 1819730
description:
Feb  6 02:06:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 02:08:24 ait sshd[920557]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 02:08:24 ait sshd[920557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.124.146
country_id: 3469034
description:
[2025-02-06 02:07:35 +0100] info [webmaild] 167.250.124.146 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.12.73.35
country_id: 3686110
description:
[2025-02-06 02:07:46 +0100] info [webmaild] 179.12.73.35 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.85.177
country_id: 3469034
description:
[2025-02-06 02:08:01 +0100] info [webmaild] 143.137.85.177 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.51.95.6
country_id: 3469034
description:
[2025-02-06 02:08:17 +0100] info [webmaild] 189.51.95.6 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Feb  6 02:08:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-02-06 02:08:46 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:51810: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
country_id: 3996063
description:
2025-02-06 02:09:20 dovecot_login authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:42096: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-02-06 02:09:24 dovecot_plain authenticator failed for (millete) [102.53.15.17]:48737: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
country_id: 1835841
description:
Feb  6 02:08:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
country_id: 1835841
description:
2025-02-06 02:08:30 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:47137: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.200.20.12
country_id: 1562822
description:
Feb  6 02:08:59 ait sshd[920650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.200.20.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.200.20.12
country_id: 1562822
description:
Feb  6 02:08:59 ait sshd[920650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.200.20.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
country_id: 3996063
description:
Feb  6 02:09:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Feb  6 02:09:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
country_id: 1835841
description:
Feb  6 02:09:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
country_id: 3017382
description:
2025-02-06 02:09:31 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:45268: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 02:09:34 ait sshd[920880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: modsec
rule: 77350222
name: IM360 WAF: Information disclosure in WPEngine plugin for WordPress
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Information disclosure in WPEngine plugin for WordPress||MV:/_wpeprivate/config.json||RSV:6.65||T:APACHE||REQUEST_URI:/_wpeprivate/config.json||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
country_id: 1835841
description:
2025-02-06 02:10:28 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:53807: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
country_id: 3469034
description:
Feb  6 02:09:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.136.139.200
country_id: 1814991
description:
Feb  6 02:09:51 ait sshd[920986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.139.200


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 02:09:34 ait sshd[920880]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-09.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
country_id: 1814991
description:
Feb  6 02:09:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 02:10:24 ait sshd[921430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
country_id: 1269750
description:
Feb  6 02:09:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 02:09:52 dovecot_login authenticator failed for ([186.200.8.115]) [186.200.249.162]:57395: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-02-06 02:10:15 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:37201: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
country_id: 1269750
description:
2025-02-06 02:09:42 dovecot_login authenticator failed for ([103.190.91.113]) [103.190.91.113]:45967: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.197.51
country_id: 3469034
description:
[2025-02-06 02:10:06 +0100] info [webmaild] 168.232.197.51 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.169.113
country_id: 2635167
description:
Feb  6 02:10:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.169.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
country_id: 1269750
description:
Feb  6 02:10:24 ait sshd[921430]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
country_id: 3017382
description:
Feb  6 02:09:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-06 02:09:29 dovecot_login authenticator failed for ([14.38.28.126]) [14.88.228.202]:52896: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  6 02:09:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
country_id: 1814991
description:
2025-02-06 02:09:52 dovecot_login authenticator failed for ([182.135.66.179]) [182.135.66.179]:44704: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
country_id: 690791
description:
Feb  6 02:10:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
country_id: 690791
description:
2025-02-06 02:10:05 dovecot_plain authenticator failed for (tremph) [109.108.95.66]:38326: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/server.cfg||User:aitext01||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.247.219
country_id: 3469034
description:
[2025-02-06 02:10:24 +0100] info [webmaild] 168.232.247.219 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
country_id: 3469034
description:
2025-02-06 02:09:51 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:41511: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
country_id: 1835841
description:
Feb  6 02:10:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.92.127
country_id: 6252001
description:
[2025-02-06 02:10:38 +0100] info [cpaneld] 156.228.92.127 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.233
country_id: 6252001
description:
[2025-02-06 02:10:43 +0100] info [whostmgrd] 156.228.114.233 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.244
country_id: 6252001
description:
[2025-02-06 02:10:47 +0100] info [whostmgrd] 156.228.111.244 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.67
country_id: 6252001
description:
[2025-02-06 02:10:54 +0100] info [whostmgrd] 156.228.85.67 - fusheini "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.43.186
country_id: 3469034
description:
[2025-02-06 02:10:57 +0100] info [webmaild] 45.5.43.186 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:6.65||T:APACHE||MV:config.php~||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.58.84.12
country_id: 3923057
description:
[2025-02-06 02:10:35 +0100] info [webmaild] 200.58.84.12 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.253
country_id: 3865483
description:
Feb  6 02:10:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.253
country_id: 3865483
description:
2025-02-06 02:10:46 dovecot_plain authenticator failed for ([167.250.119.253]) [167.250.119.253]:37215: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 02:11:08 ait sshd[921708]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.183.209.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.104.13
country_id: 6252001
description:
[2025-02-06 02:10:39 +0100] info [cpaneld] 156.228.104.13 - fusheini "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fusheini (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.40
country_id: 6252001
description:
[2025-02-06 02:10:31 +0100] info [cpaneld] 104.207.58.40 - fusheini "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fusheini (has_cpuser_file failed)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/app/config/parameters.yml||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.124.79
country_id: 6252001
description:
[2025-02-06 02:10:58 +0100] info [whostmgrd] 156.228.124.79 - fusheini "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 02:11:08 ait sshd[921708]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.183.209.179


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.176
country_id: 6252001
description:
[2025-02-06 02:10:36 +0100] info [cpaneld] 156.228.83.176 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.122
country_id: 6252001
description:
[2025-02-06 02:10:41 +0100] info [cpaneld] 156.228.81.122 - fusheini "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user fusheini (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.62
country_id: 6252001
description:
[2025-02-06 02:10:45 +0100] info [whostmgrd] 104.207.45.62 - fusheini "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
country_id: 2077456
description:
Feb  6 02:12:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
country_id: 2077456
description:
2025-02-06 02:12:25 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:56436: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.80
country_id: 99237
description:
Feb  6 02:11:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/config.conf||User:aitext01||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 02:12:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Feb  6 02:12:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.80
country_id: 99237
description:
2025-02-06 02:11:37 dovecot_plain authenticator failed for (dishramin) [65.20.250.80]:49181: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-02-06 02:12:20 dovecot_plain authenticator failed for ([37.57.69.227]) [37.57.69.227]:47912: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
country_id: 1269750
description:
Feb  6 02:12:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 02:13:07 ait sshd[922340]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
country_id: 3469034
description:
Feb  6 02:13:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-06 02:13:12 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:42982: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 02:13:07 ait sshd[922340]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-02-06 02:12:37 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:59344: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.179.253.150
country_id: 2542007
description:
[2025-02-06 02:13:02 +0100] info [webmaild] 160.179.253.150 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.81.75.159
country_id: 3469034
description:
[2025-02-06 02:13:05 +0100] info [webmaild] 177.81.75.159 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
country_id: 2017370
description:
2025-02-06 02:12:39 dovecot_plain authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:54934: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
country_id: 1835841
description:
Feb  6 02:12:40 ait sshd[922254]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
country_id: 1835841
description:
Feb  6 02:12:40 ait sshd[922254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
country_id: 1814991
description:
Feb  6 02:12:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.51.213
country_id: 2017370
description:
Feb  6 02:12:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.51.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
country_id: 1814991
description:
2025-02-06 02:12:46 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:37742: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.85.42
country_id: 3469034
description:
[2025-02-06 02:13:33 +0100] info [webmaild] 177.37.85.42 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.106.240.60
country_id: 3469034
description:
[2025-02-06 02:13:37 +0100] info [webmaild] 189.106.240.60 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/config.php.bak||User:aitext01||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
country_id: 3017382
description:
Feb  6 02:13:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
country_id: 3017382
description:
2025-02-06 02:13:38 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (secke) [51.255.84.180]:47332: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
country_id: 690791
description:
Feb  6 02:14:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 02:15:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.212.9
country_id: 2017370
description:
Feb  6 02:15:27 ait sshd[923162]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.87.212.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
country_id: 2017370
description:
Feb  6 02:14:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.90.174.103
country_id: 2921044
description:
Feb  6 02:14:59 ait sshd[922839]: pam_imunify(sshd:auth): [IM360_RBL] The IP 164.90.174.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.90.174.103
country_id: 2921044
description:
Feb  6 02:14:59 ait sshd[922839]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.90.174.103  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-06 02:14:37 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (munkited) [92.244.126.105]:55892: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.87.212.9
country_id: 2017370
description:
Feb  6 02:15:27 ait sshd[923162]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.87.212.9  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.73.202.91
country_id: 2542007
description:
Feb  6 02:14:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.73.202.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.73.202.91
country_id: 2542007
description:
2025-02-06 02:14:32 dovecot_plain authenticator failed for (prephak) [105.73.202.91]:50168: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 02:15:18 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:59246: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
country_id: 2017370
description:
2025-02-06 02:14:31 dovecot_plain authenticator failed for (unmelotiza) [94.140.210.134]:52216: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:6.65||T:APACHE||MV:configure.php~||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.58.118
country_id: 1835841
description:
Feb  6 02:15:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.58.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.202.190
country_id: 3469034
description:
[2025-02-06 02:16:02 +0100] info [webmaild] 170.79.202.190 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.53.99.24
country_id: 3686110
description:
[2025-02-06 02:16:05 +0100] info [webmaild] 181.53.99.24 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 02:16:10 ait sshd[923475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.253.169.245
country_id: 3469034
description:
[2025-02-06 02:15:34 +0100] info [webmaild] 179.253.169.245 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  6 02:16:10 ait sshd[923475]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.58.118
country_id: 1835841
description:
2025-02-06 02:15:32 dovecot_plain authenticator failed for ([61.76.58.118]) [61.76.58.118]:44400: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.81.166.167
country_id: 3469034
description:
[2025-02-06 02:15:32 +0100] info [webmaild] 177.81.166.167 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  6 02:15:44 ait sshd[923200]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
country_id: 1269750
description:
Feb  6 02:15:44 ait sshd[923200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41  user=root


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/config.json.bak||User:aitext01||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
country_id: 3144096
description:
Feb  6 02:16:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
country_id: 1814991
description:
2025-02-06 02:16:45 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:43114: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
country_id: 1814991
description:
Feb  6 02:16:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2025-02-06 02:16:55 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:55662: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 02:16:56 ait sshd[923666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
country_id: 6252001
description:
Feb  6 02:17:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
country_id: 1814991
description:
Feb  6 02:16:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
country_id: 1814991
description:
2025-02-06 02:16:32 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:46073: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
country_id: 1814991
description:
Feb  6 02:16:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
country_id: 1819730
description:
Feb  6 02:16:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
country_id: 1819730
description:
2025-02-06 02:16:49 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:64822: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
country_id: 6252001
description:
2025-02-06 02:17:04 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:35778: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 02:17:27 ait sshd[923881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 02:17:27 ait sshd[923881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
country_id: 3144096
description:
2025-02-06 02:16:34 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (poeley) [195.159.217.71]:53418: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 02:16:56 ait sshd[923666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
country_id: 6252001
description:
Feb  6 02:17:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
country_id: 6252001
description:
2025-02-06 02:17:09 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:53070: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  6 02:17:35 ait sshd[923910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.211.6
country_id: 3658394
description:
[2025-02-06 02:18:00 +0100] info [webmaild] 177.234.211.6 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.106
country_id: 2635167
description:
Feb  6 02:18:21 ait sshd[924010]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.21.209
country_id: 1814991
description:
Feb  6 02:17:35 ait sshd[923910]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.21.209 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.106
country_id: 2635167
description:
Feb  6 02:18:21 ait sshd[924010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.106  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.113.48.139
country_id: 3469034
description:
[2025-02-06 02:18:08 +0100] info [webmaild] 189.113.48.139 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 02:18:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.69.177.223
country_id: 3658394
description:
[2025-02-06 02:18:29 +0100] info [webmaild] 186.69.177.223 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.130.215
country_id: 3469034
description:
[2025-02-06 02:18:41 +0100] info [webmaild] 168.232.130.215 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
country_id: 2661886
description:
2025-02-06 02:20:09 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:37986: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.152.193
country_id: 1861060
description:
Feb  6 02:20:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.152.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.152.193
country_id: 1861060
description:
2025-02-06 02:20:22 dovecot_login authenticator failed for p243193-obmd01.tokyo.ocn.ne.jp [153.141.152.193]:45055: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/configs/application.ini||User:aitext01||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.138.132.109
country_id: 1814991
description:
Feb  6 02:20:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.138.132.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
country_id: 1814991
description:
Feb  6 02:19:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
country_id: 1814991
description:
2025-02-06 02:19:58 dovecot_plain authenticator failed for ([115.85.251.188]) [115.85.251.188]:55378: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.211.174
country_id: 174982
description:
Feb  6 02:20:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.211.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
country_id: 1819730
description:
2025-02-06 02:19:49 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:61989: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.211.174
country_id: 174982
description:
2025-02-06 02:20:03 dovecot_login authenticator failed for (host-174.211.77.5.ucom.am) [5.77.211.174]:36273: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
country_id: 2661886
description:
Feb  6 02:20:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.138.132.109
country_id: 1814991
description:
2025-02-06 02:20:23 dovecot_plain authenticator failed for ([36.138.132.109]) [36.138.132.109]:51548: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
country_id: 1819730
description:
Feb  6 02:19:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
country_id: 1819730
description:
2025-02-06 02:19:44 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:34960: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
country_id: 1819730
description:
Feb  6 02:19:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.118.53
country_id: 3865483
description:
Feb  6 02:20:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.118.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-02-06 02:20:37 dovecot_plain authenticator failed for ([167.250.118.53]) [167.250.118.53]:49895: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
country_id: 1814991
description:
2025-02-06 02:20:51 dovecot_plain authenticator failed for ([1.183.1.82]) [1.183.1.82]:57982: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.132.170
country_id: 1814991
description:
2025-02-06 02:21:02 dovecot_plain authenticator failed for ([117.32.132.170]) [117.32.132.170]:52096: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
country_id: 1814991
description:
Feb  6 02:20:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
country_id: 3017382
description:
Feb  6 02:21:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
country_id: 3469034
description:
2025-02-06 02:21:18 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:36311: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.232.113
country_id: 1605651
description:
Feb  6 02:21:28 ait sshd[925165]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.232.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/php.ini-orig.txt||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.182.34
country_id: 3469034
description:
[2025-02-06 02:20:35 +0100] info [webmaild] 170.233.182.34 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.188.24
country_id: 3469034
description:
[2025-02-06 02:20:45 +0100] info [webmaild] 186.219.188.24 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.182.140.83
country_id: 3625428
description:
[2025-02-06 02:21:03 +0100] info [webmaild] 45.182.140.83 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
country_id: 1880251
description:
2025-02-06 02:21:17 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:40203: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
country_id: 3017382
description:
2025-02-06 02:21:07 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:44148: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
country_id: 290557
description:
2025-02-06 02:21:09 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:59027: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.172.79.112
country_id: 1880251
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:aitext01||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
country_id: 290557
description:
Feb  6 02:21:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
country_id: 1880251
description:
Feb  6 02:21:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 02:21:21 ait sshd[925158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.232.113
country_id: 1605651
description:
Feb  6 02:21:28 ait sshd[925165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.232.113  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
country_id: 3469034
description:
Feb  6 02:21:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.4.108.13
country_id: 3469034
description:
[2025-02-06 02:21:19 +0100] info [webmaild] 189.4.108.13 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 02:21:21 ait sshd[925158]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.132.170
country_id: 1814991
description:
Feb  6 02:21:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.132.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  6 02:21:46 ait sshd[925406]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.19.211.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.101.77
country_id: 1814991
description:
Feb  6 02:21:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.101.77
country_id: 1814991
description:
2025-02-06 02:21:50 dovecot_plain authenticator failed for ([112.26.101.77]) [112.26.101.77]:52652: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.117.186
country_id: 1814991
description:
Feb  6 02:22:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.117.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
country_id: 1814991
description:
2025-02-06 02:22:02 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:49661: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
country_id: 3469034
description:
2025-02-06 02:21:39 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:49478: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  6 02:21:46 ait sshd[925406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.19.211.4  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
country_id: 1814991
description:
Feb  6 02:22:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
country_id: 1814991
description:
2025-02-06 02:22:01 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:33694: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
country_id: 1814991
description:
Feb  6 02:21:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 02:22:24 ait sshd[925496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 02:22:24 ait sshd[925496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
country_id: 3469034
description:
Feb  6 02:21:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.239.187.13
country_id: 1819730
description:
Feb  6 02:21:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.239.187.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.239.187.13
country_id: 1819730
description:
2025-02-06 02:21:41 dovecot_plain authenticator failed for ([20.239.187.13]) [20.239.187.13]:38586: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.117.186
country_id: 1814991
description:
2025-02-06 02:22:03 dovecot_plain authenticator failed for ([60.219.117.186]) [60.219.117.186]:59880: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 02:23:04 ait sshd[925686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.88.123
country_id: 3469034
description:
[2025-02-06 02:23:12 +0100] info [webmaild] 170.84.88.123 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
country_id: 6251999
description:
Feb  6 02:23:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
country_id: 1880251
description:
Feb  6 02:22:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.124.204
country_id: 2215636
description:
2025-02-06 02:22:40 dovecot_plain authenticator failed for (ducippin) [165.16.124.204]:58232: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.225.109.30
country_id: 1733045
description:
Feb  6 02:22:48 ait sshd[925649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.225.109.30


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.48.210
country_id: 1814991
description:
Feb  6 02:23:20 ait sshd[925640]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.73.48.210 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.73.48.210
country_id: 1814991
description:
Feb  6 02:23:20 ait sshd[925640]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.48.210


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 02:23:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
country_id: 1814991
description:
Feb  6 02:22:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
country_id: 1880251
description:
2025-02-06 02:22:42 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:47160: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.109.30
country_id: 1733045
description:
Feb  6 02:22:48 ait sshd[925649]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.225.109.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.63.242
country_id: 1835841
description:
Feb  6 02:23:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.63.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
country_id: 1835841
description:
2025-02-06 02:23:09 dovecot_plain authenticator failed for ([1.252.63.242]) [1.252.63.242]:48296: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.43.10.185
country_id: 357994
description:
[2025-02-06 02:23:14 +0100] info [webmaild] 197.43.10.185 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-06 02:23:17 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:43500: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.124.204
country_id: 2215636
description:
Feb  6 02:22:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.124.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
country_id: 1814991
description:
2025-02-06 02:22:44 dovecot_login authenticator failed for ([222.216.2.74]) [222.216.2.74]:53187: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
country_id: 732800
description:
Feb  6 02:23:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 02:23:04 ait sshd[925686]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-02-06 02:23:06 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:31654: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
country_id: 3469034
description:
Feb  6 02:23:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
country_id: 6251999
description:
2025-02-06 02:23:30 dovecot_login authenticator failed for ([207.219.221.99]) [207.219.221.99]:59276: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 02:23:31 ait sshd[925840]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 02:23:31 ait sshd[925840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
country_id: 3508796
description:
2025-02-06 02:23:42 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:45444: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.149.95.176
country_id: 690791
description:
[2025-02-06 02:23:47 +0100] info [webmaild] 46.149.95.176 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
country_id: 1835841
description:
2025-02-06 02:23:57 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:60995: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
country_id: 2453866
description:
Feb  6 02:24:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
country_id: 2453866
description:
2025-02-06 02:24:13 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:34178: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
country_id: 1819730
description:
Feb  6 02:24:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
country_id: 1819730
description:
2025-02-06 02:24:28 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:20546: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
country_id: 3508796
description:
Feb  6 02:23:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
country_id: 1814991
description:
Feb  6 02:23:41 ait sshd[925889]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.233.80
country_id: 3469034
description:
[2025-02-06 02:23:41 +0100] info [webmaild] 177.37.233.80 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
country_id: 1835841
description:
Feb  6 02:23:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-24.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
country_id: 1814991
description:
Feb  6 02:23:41 ait sshd[925889]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.47.172.133
country_id: 1831722
description:
Feb  6 02:24:43 ait sshd[926131]: pam_imunify(sshd:auth): [IM360_RBL] The IP 163.47.172.133 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 163.47.172.133
country_id: 1831722
description:
Feb  6 02:24:43 ait sshd[926131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=163.47.172.133  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.124.30.225
country_id: 2750405
description:
Feb  6 02:25:45 ait sshd[926559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.124.30.225  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.94.164.162
country_id: 1210997
description:
[2025-02-06 02:26:20 +0100] info [webmaild] 202.94.164.162 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.93.3.115
country_id: 3624060
description:
[2025-02-06 02:26:26 +0100] info [webmaild] 177.93.3.115 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
country_id: 1819730
description:
2025-02-06 02:25:44 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:5929: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.243.224
country_id: 3469034
description:
[2025-02-06 02:25:54 +0100] info [webmaild] 45.179.243.224 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
country_id: 1814991
description:
Feb  6 02:25:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.129.200.113
country_id: 2077456
description:
Feb  6 02:26:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.129.200.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.16.59
country_id: 732800
description:
Feb  6 02:26:28 ait sshd[926796]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.16.59  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Feb  6 02:25:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
country_id: 1819730
description:
Feb  6 02:25:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.124.30.225
country_id: 2750405
description:
Feb  6 02:25:45 ait sshd[926559]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.124.30.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.224.65
country_id: 3469034
description:
[2025-02-06 02:25:51 +0100] info [webmaild] 170.83.224.65 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.200.113
country_id: 2077456
description:
2025-02-06 02:26:20 dovecot_plain authenticator failed for (115-129-200-113.tpgi.com.au) [115.129.200.113]:55106: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 02:26:21 ait sshd[926788]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2025-02-06 02:25:34 dovecot_plain authenticator failed for (nonseweber) [102.53.15.180]:54668: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
country_id: 1814991
description:
2025-02-06 02:26:00 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:8930: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 02:26:21 ait sshd[926788]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-02-06 02:26:33 dovecot_plain authenticator failed for (unaweing) [64.72.74.162]:39004: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.138.18
country_id: 3469034
description:
Feb  6 02:26:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.138.18 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.218.215.240
country_id: 953987
description:
Feb  6 02:27:12 ait sshd[926987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.218.215.240


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
country_id: 2750405
description:
2025-02-06 02:26:35 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:46668: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.138.18
country_id: 3469034
description:
2025-02-06 02:27:01 dovecot_plain authenticator failed for ([189.44.138.18]) [189.44.138.18]:42515: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
country_id: 6252001
description:
Feb  6 02:27:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  6 02:26:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
country_id: 1605651
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-26.202.29.30.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
country_id: 6252001
description:
2025-02-06 02:27:20 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:46830: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
country_id: 2750405
description:
Feb  6 02:26:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 02:27:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.218.215.240
country_id: 953987
description:
Feb  6 02:27:12 ait sshd[926987]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.218.215.240 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.226.90.120
country_id: 3996063
description:
[2025-02-06 02:28:25 +0100] info [webmaild] 187.226.90.120 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
country_id: 1814991
description:
Feb  6 02:27:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
country_id: 99237
description:
Feb  6 02:27:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
country_id: 2661886
description:
2025-02-06 02:27:56 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:58268: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
country_id: 1643084
description:
Feb  6 02:28:05 ait sshd[927299]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
country_id: 2542007
description:
Feb  6 02:27:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
country_id: 99237
description:
2025-02-06 02:27:41 dovecot_plain authenticator failed for (eneste) [65.20.160.195]:43848: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
country_id: 1814991
description:
2025-02-06 02:27:46 dovecot_login authenticator failed for ([39.155.170.146]) [39.155.170.146]:56034: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
country_id: 2661886
description:
Feb  6 02:27:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2025-02-06 02:27:37 dovecot_plain authenticator failed for (thydry) [41.248.243.181]:36770: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
country_id: 1643084
description:
Feb  6 02:28:05 ait sshd[927299]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.191.241.107
country_id: 3469034
description:
[2025-02-06 02:28:52 +0100] info [webmaild] 179.191.241.107 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.32.190
country_id: 3469034
description:
[2025-02-06 02:28:55 +0100] info [webmaild] 45.187.32.190 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
country_id: 298795
description:
Feb  6 02:28:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.221.223.159
country_id: 1562822
description:
Feb  6 02:29:07 ait sshd[927632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.221.223.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.22.206
country_id: 1880251
description:
Feb  6 02:28:40 ait sshd[927528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.22.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.22.206
country_id: 1880251
description:
Feb  6 02:28:40 ait sshd[927528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.22.206


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.221.223.159
country_id: 1562822
description:
Feb  6 02:29:07 ait sshd[927632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.221.223.159


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.152.58.131
country_id: 3686110
description:
[2025-02-06 02:29:24 +0100] info [webmaild] 24.152.58.131 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.123.16.59
country_id: 732800
description:
Feb  6 02:28:54 ait sshd[927562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.123.16.59  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
country_id: 298795
description:
2025-02-06 02:29:01 dovecot_plain authenticator failed for (prochly) [149.0.19.108]:51430: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.138.130.17
country_id: 2921044
description:
Feb  6 02:28:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.138.130.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.138.130.17
country_id: 2921044
description:
2025-02-06 02:28:31 dovecot_plain authenticator failed for p578a8211.dip0.t-ipconnect.de (silly) [87.138.130.17]:54994: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.65.27
country_id: 732800
description:
2025-02-06 02:29:39 dovecot_plain authenticator failed for 46-10-65-27.ip.btc-net.bg [46.10.65.27]:40024: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
country_id: 1814991
description:
Feb  6 02:29:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
country_id: 99237
description:
Feb  6 02:30:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
country_id: 1269750
description:
2025-02-06 02:29:40 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:34140: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
country_id: 99237
description:
2025-02-06 02:30:08 dovecot_login authenticator failed for ([65.20.191.97]) [65.20.191.97]:55251: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
country_id: 6252001
description:
Feb  6 02:29:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
country_id: 1880251
description:
Feb  6 02:29:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
country_id: 1880251
description:
2025-02-06 02:29:31 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:56109: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
country_id: 6252001
description:
2025-02-06 02:29:30 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:47719: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
country_id: 6252001
description:
Feb  6 02:30:18 ait sshd[928008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
country_id: 6252001
description:
Feb  6 02:30:18 ait sshd[928008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.10.65.27
country_id: 732800
description:
Feb  6 02:29:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.10.65.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
country_id: 1269750
description:
Feb  6 02:29:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
country_id: 1814991
description:
2025-02-06 02:29:59 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:38325: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
country_id: 2077456
description:
Feb  6 02:30:54 ait sshd[928251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.222.191.232
country_id: 3469034
description:
[2025-02-06 02:31:01 +0100] info [webmaild] 179.222.191.232 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.75.223.17
country_id: 1814991
description:
Feb  6 02:31:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.75.223.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.223.17
country_id: 1814991
description:
2025-02-06 02:31:23 dovecot_login authenticator failed for ([111.75.223.19]) [111.75.223.17]:41433: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 02:30:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
country_id: 2077456
description:
Feb  6 02:30:54 ait sshd[928251]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.187.154
country_id: 1269750
description:
Feb  6 02:31:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.187.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.213.164.27
country_id: 1835841
description:
2025-02-06 02:31:40 dovecot_login authenticator failed for ([1.213.164.27]) [1.213.164.27]:56860: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2025-02-06 02:31:43 dovecot_login authenticator failed for ([113.193.187.154]) [113.193.187.154]:56674: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
country_id: 6251999
description:
Feb  6 02:31:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-06 02:32:03 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (perphyra) [92.244.126.105]:44153: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.94.213.56
country_id: 3625428
description:
[2025-02-06 02:31:30 +0100] info [webmaild] 190.94.213.56 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.116.56.114
country_id: 3469034
description:
[2025-02-06 02:31:29 +0100] info [webmaild] 179.116.56.114 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
country_id: 1814991
description:
2025-02-06 02:31:45 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:49204: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
country_id: 99237
description:
Feb  6 02:31:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
country_id: 3932488
description:
Feb  6 02:31:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.117.10.134
country_id: 1814991
description:
Feb  6 02:31:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.117.10.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
country_id: 6251999
description:
2025-02-06 02:31:59 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:38068: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-02-06 02:31:29 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:56828: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.205
country_id: 99237
description:
2025-02-06 02:31:59 dovecot_plain authenticator failed for (isbers) [65.20.155.205]:34299: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
country_id: 690791
description:
Feb  6 02:32:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.208.21
country_id: 3865483
description:
[2025-02-06 02:32:01 +0100] info [webmaild] 179.60.208.21 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.213.164.27
country_id: 1835841
description:
Feb  6 02:31:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.213.164.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
country_id: 3996063
description:
2025-02-06 02:33:24 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:60977: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
country_id: 1835841
description:
Feb  6 02:32:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
country_id: 1835841
description:
2025-02-06 02:32:36 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:49044: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.70.70
country_id: 1814991
description:
Feb  6 02:32:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.70.70
country_id: 1814991
description:
2025-02-06 02:32:47 dovecot_plain authenticator failed for ([1.26.70.70]) [1.26.70.70]:22218: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.84.62.213
country_id: 1269750
description:
Feb  6 02:33:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.84.62.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.62.213
country_id: 1269750
description:
2025-02-06 02:33:13 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.62.213]:29751: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
country_id: 3996063
description:
Feb  6 02:33:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 02:33:33 ait sshd[929031]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.87.154.121
country_id: 1605651
description:
Feb  6 02:33:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.87.154.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.175.15.10
country_id: 1522867
description:
[2025-02-06 02:34:09 +0100] info [webmaild] 192.175.15.10 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
country_id: 3469034
description:
Feb  6 02:34:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.100.134
country_id: 3469034
description:
[2025-02-06 02:33:41 +0100] info [webmaild] 186.237.100.134 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.31.12.187
country_id: 1562822
description:
Feb  6 02:33:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.31.12.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.31.12.187
country_id: 1562822
description:
2025-02-06 02:33:54 dovecot_login authenticator failed for (static.vnpt.vn) [123.31.12.187]:54930: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.203.234
country_id: 3625428
description:
[2025-02-06 02:34:09 +0100] info [webmaild] 45.186.203.234 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 02:33:33 ait sshd[929031]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.87.154.121
country_id: 1605651
description:
2025-02-06 02:33:39 dovecot_login authenticator failed for ppp-115-87-154-121.revip4.asianet.co.th [115.87.154.121]:53955: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-06 02:34:23 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:48313: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 02:34:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.157.142
country_id: 1835841
description:
Feb  6 02:34:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.157.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.157.142
country_id: 1835841
description:
2025-02-06 02:34:39 dovecot_plain authenticator failed for ([61.80.157.142]) [61.80.157.142]:41671: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
country_id: 1522867
description:
Feb  6 02:35:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-06 02:35:25 dovecot_plain authenticator failed for (sycaping) [109.166.70.166]:25598: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
country_id: 798544
description:
Feb  6 02:35:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.99.67
country_id: 3469034
description:
[2025-02-06 02:34:41 +0100] info [webmaild] 45.237.99.67 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
country_id: 798544
description:
2025-02-06 02:35:28 dovecot_plain authenticator failed for (xagloraum) [93.159.152.6]:45954: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.42.19
country_id: 3175395
description:
Feb  6 02:35:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.4.42.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
country_id: 1835841
description:
Feb  6 02:35:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
country_id: 1835841
description:
2025-02-06 02:35:50 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:51703: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
country_id: 3144096
description:
2025-02-06 02:35:51 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:39764: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.4.42.19
country_id: 3175395
description:
2025-02-06 02:35:41 dovecot_plain authenticator failed for (host-194-4-42-19.net.intranetwifi.it) [194.4.42.19]:35238: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
country_id: 1814991
description:
Feb  6 02:36:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.153.155.171
country_id: 1210997
description:
[2025-02-06 02:36:15 +0100] info [webmaild] 103.153.155.171 - feedback@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-02-06 02:36:15 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:49903: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
country_id: 3144096
description:
Feb  6 02:35:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.218.48
country_id: 2017370
description:
Feb  6 02:35:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.218.48
country_id: 2017370
description:
2025-02-06 02:35:51 dovecot_plain authenticator failed for ([46.45.218.48]) [46.45.218.48]:57962: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
country_id: 1814991
description:
2025-02-06 02:36:02 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:34746: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
country_id: 6252001
description:
Feb  6 02:36:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  6 02:36:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-02-06 02:36:51 dovecot_plain authenticator failed for (platin) [64.72.74.162]:37807: 535 Incorrect authentication data (set_id=mordzifa@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
country_id: 1814991
description:
Feb  6 02:37:18 ait sshd[930365]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.161.252
country_id: 3469034
description:
[2025-02-06 02:36:40 +0100] info [webmaild] 45.173.161.252 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.142.54.192
country_id: 248816
description:
[2025-02-06 02:36:42 +0100] info [webmaild] 94.142.54.192 - feedback@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
country_id: 1814991
description:
Feb  6 02:37:18 ait sshd[930365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.231.101
country_id: 3469034
description:
[2025-02-06 02:37:17 +0100] info [webmaild] 177.37.231.101 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 02:37:31 ait sshd[930401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.39.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.65.227
country_id: 1835841
description:
Feb  6 02:37:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.65.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
country_id: 2017370
description:
2025-02-06 02:37:40 dovecot_plain authenticator failed for (asthrows) [89.23.210.188]:58922: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.63.75.171
country_id: 1814991
description:
Feb  6 02:37:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.63.75.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
country_id: 1814991
description:
2025-02-06 02:38:12 dovecot_plain authenticator failed for ([60.14.36.47]) [60.14.36.47]:48969: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
country_id: 1814991
description:
Feb  6 02:38:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
country_id: 6252001
description:
Feb  6 02:37:31 ait sshd[930401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
country_id: 2017370
description:
Feb  6 02:37:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  6 02:37:50 ait sshd[930529]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.5.245.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.14.36.47
country_id: 1814991
description:
Feb  6 02:38:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.14.36.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.23.117.97
country_id: 1814991
description:
Feb  6 02:37:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.23.117.97 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  6 02:37:50 ait sshd[930529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.5.245.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
country_id: 290557
description:
Feb  6 02:38:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
country_id: 290557
description:
2025-02-06 02:38:12 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:39371: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.245.29.237
country_id: 1835841
description:
Feb  6 02:38:16 ait sshd[930589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.245.29.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.245.29.237
country_id: 1835841
description:
Feb  6 02:38:16 ait sshd[930589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.245.29.237


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.87.10
country_id: 1814991
description:
2025-02-06 02:38:37 dovecot_plain authenticator failed for ([183.24.87.10]) [183.24.87.10]:60739: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.4
country_id: 99237
description:
Feb  6 02:39:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.24.87.10
country_id: 1814991
description:
Feb  6 02:38:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.24.87.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.48.195.238
country_id: 3469034
description:
[2025-02-06 02:39:17 +0100] info [webmaild] 179.48.195.238 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
country_id: 1819730
description:
2025-02-06 02:38:35 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:63738: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.109
country_id: 1668284
description:
2025-02-06 02:38:50 dovecot_plain authenticator failed for 111-70-25-109.emome-ip.hinet.net [111.70.25.109]:44987: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-02-06 02:39:16 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:52623: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
country_id: 99237
description:
2025-02-06 02:39:24 dovecot_plain authenticator failed for (focyamy) [65.20.133.4]:60560: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
country_id: 1835841
description:
2025-02-06 02:38:34 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:56584: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
country_id: 1835841
description:
Feb  6 02:38:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
country_id: 1880251
description:
2025-02-06 02:39:06 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:44836: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
country_id: 1814991
description:
2025-02-06 02:38:30 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:41810: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  6 02:38:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-06 02:38:37 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:50542: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
country_id: 1835841
description:
2025-02-06 02:38:46 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:55934: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-38.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
country_id: 1880251
description:
Feb  6 02:39:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
country_id: 1835841
description:
Feb  6 02:38:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.109
country_id: 1668284
description:
Feb  6 02:38:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
country_id: 3469034
description:
Feb  6 02:39:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
country_id: 1819730
description:
Feb  6 02:38:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.27.35
country_id: 1880251
description:
47.128.27.35 - - [06/Feb/2025:02:39:14 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18170958 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?duration=short&filtering=1&level=beginner%2Cexpert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.27.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.168.177.6
country_id: 3686110
description:
[2025-02-06 02:39:31 +0100] info [webmaild] 186.168.177.6 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.113.115.205
country_id: 3624060
description:
[2025-02-06 02:39:48 +0100] info [webmaild] 190.113.115.205 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.46.148.83
country_id: 2017370
description:
[2025-02-06 02:39:54 +0100] info [webmaild] 95.46.148.83 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
country_id: 1694008
description:
Feb  6 02:39:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 02:39:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
country_id: 1814991
description:
Feb  6 02:41:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.63
country_id: 2635167
description:
Feb  6 02:40:32 ait sshd[931374]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.63
country_id: 2635167
description:
Feb  6 02:40:32 ait sshd[931374]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.63  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
country_id: 1819730
description:
Feb  6 02:41:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
country_id: 614540
description:
2025-02-06 02:41:26 dovecot_plain authenticator failed for ([185.207.129.246]) [185.207.129.246]:59610: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
country_id: 1819730
description:
2025-02-06 02:41:28 dovecot_login authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:42310: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
country_id: 1814991
description:
2025-02-06 02:41:28 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:54883: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.140.69
country_id: 99237
description:
Feb  6 02:40:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.140.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
country_id: 614540
description:
Feb  6 02:41:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
country_id: 2017370
description:
2025-02-06 02:41:26 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:52530: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.140.69
country_id: 99237
description:
2025-02-06 02:40:36 dovecot_plain authenticator failed for (chion) [65.20.140.69]:51690: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
country_id: 2017370
description:
Feb  6 02:41:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.192.20.166
country_id: 3175395
description:
Feb  6 02:41:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.192.20.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
country_id: 1835841
description:
2025-02-06 02:41:37 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:48921: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
country_id: 6252001
description:
Feb  6 02:41:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
country_id: 290557
description:
2025-02-06 02:41:40 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:59063: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.109.37
country_id: 1210997
description:
Feb  6 02:41:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-02-06 02:42:00 dovecot_plain authenticator failed for ([103.245.109.37]) [103.245.109.37]:53932: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.173.92.153
country_id: 3865483
description:
[2025-02-06 02:42:26 +0100] info [webmaild] 190.173.92.153 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
country_id: 1835841
description:
Feb  6 02:41:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
country_id: 1835841
description:
Feb  6 02:41:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2025-02-06 02:41:37 dovecot_plain authenticator failed for ([116.113.254.26]) [116.113.254.26]:56758: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
country_id: 1814991
description:
Feb  6 02:41:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Feb  6 02:41:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


