# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
description:
Feb  5 16:24:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
description:
2025-02-05 16:24:44 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:44538: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-02-05 16:24:46 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:41686: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 16:25:04 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:42379: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.220
description:
Feb  5 16:25:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Feb  5 16:25:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
description:
Feb  5 16:24:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
description:
2025-02-05 16:24:58 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:60581: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.77.205.70
description:
[2025-02-05 16:25:22 +0100] info [webmaild] 5.77.205.70 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.160.175
description:
Feb  5 16:25:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.160.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-02-05 16:24:46 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:35929: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-02-05 16:25:22 dovecot_login authenticator failed for ([58.42.226.215]) [58.42.226.215]:60863: 535 Incorrect authentication data (set_id=test@ait-edu.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.170.61.212
description:
[2025-02-05 16:24:50 +0100] info [webmaild] 93.170.61.212 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.99.237.249
description:
Feb  5 16:24:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.99.237.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.237.249
description:
2025-02-05 16:24:54 dovecot_plain authenticator failed for ([222.99.237.249]) [222.99.237.249]:34630: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.193.93
description:
[2025-02-05 16:25:05 +0100] info [webmaild] 45.186.193.93 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Feb  5 16:25:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Feb  5 16:25:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
description:
2025-02-05 16:25:30 dovecot_login authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:35241: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Feb  5 16:25:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
description:
Feb  5 16:25:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
description:
2025-02-05 16:26:01 dovecot_login authenticator failed for ([101.13.4.119]) [101.13.4.119]:38930: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.118.230
description:
Feb  5 16:26:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.118.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.118.230
description:
2025-02-05 16:26:10 dovecot_login authenticator failed for ([182.70.118.230]) [182.70.118.230]:56852: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Feb  5 16:26:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-02-05 16:26:24 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:52030: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.96.151.110
description:
Feb  5 16:27:11 ait sshd[661154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.96.151.110


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.62.50.2
description:
[2025-02-05 16:27:22 +0100] info [webmaild] 206.62.50.2 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-02-05 16:27:33 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:48236: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.77.193.92
description:
2025-02-05 16:27:33 dovecot_plain authenticator failed for vps-de4e2f27.vps.ovh.net [51.77.193.92]:44990: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.87.170
description:
Feb  5 16:26:43 ait sshd[660917]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.87.170


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.96.151.110
description:
Feb  5 16:27:11 ait sshd[661154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.96.151.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.59.235.170
description:
Feb  5 16:26:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.59.235.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.165.244.225
description:
Feb  5 16:27:04 ait sshd[661136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.165.244.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.59.235.170
description:
2025-02-05 16:26:49 dovecot_plain authenticator failed for ([222.175.187.214]) [218.59.235.170]:33219: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Feb  5 16:27:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.77.193.92
description:
Feb  5 16:27:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.77.193.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.87.170
description:
Feb  5 16:26:43 ait sshd[660917]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.87.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.187.174
description:
[2025-02-05 16:27:11 +0100] info [webmaild] 45.230.187.174 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.79.67
description:
[2025-02-05 16:27:43 +0100] info [webmaild] 131.196.79.67 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
description:
2025-02-05 16:27:53 dovecot_plain authenticator failed for ([36.26.63.158]) [36.26.63.158]:41666: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  5 16:28:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.108
description:
Feb  5 16:28:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.101.124
description:
Feb  5 16:27:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.101.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
description:
Feb  5 16:27:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-05 16:28:02 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:30056: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.87.170
description:
Feb  5 16:28:07 ait sshd[661519]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.87.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-05 16:28:14 dovecot_login authenticator failed for ([222.236.59.174]) [222.236.59.174]:42824: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.207.231.65
description:
Feb  5 16:27:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.207.231.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.207.231.65
description:
2025-02-05 16:27:42 dovecot_plain authenticator failed for ([111.207.231.67]) [111.207.231.65]:54527: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.108
description:
2025-02-05 16:28:03 dovecot_login authenticator failed for ([112.91.124.108]) [112.91.124.108]:53980: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.87.170
description:
Feb  5 16:28:09 ait sshd[661519]: Failed password for invalid user ftpuser from 139.59.87.170 port 41304 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.96.101.124
description:
2025-02-05 16:27:42 dovecot_plain authenticator failed for ([186.96.101.124]) [186.96.101.124]:44894: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.235.206.86
description:
[2025-02-05 16:27:51 +0100] info [webmaild] 190.235.206.86 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.87.170
description:
Feb  5 16:28:07 ait sshd[661519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.87.170


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  5 16:28:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.165.244.225
description:
Feb  5 16:28:37 ait sshd[661703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.165.244.225


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Feb  5 16:29:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-02-05 16:29:15 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:53456: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-02-05 16:29:18 dovecot_plain authenticator failed for ([179.185.1.177]) [179.185.1.177]:38477: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.172
description:
2025-02-05 16:29:32 dovecot_plain authenticator failed for ([61.80.161.172]) [61.80.161.172]:55177: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
description:
2025-02-05 16:29:34 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:58944: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 16:29:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
description:
2025-02-05 16:29:10 dovecot_plain authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:38803: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Feb  5 16:29:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
description:
Feb  5 16:29:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
description:
Feb  5 16:29:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-02-05 16:29:04 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:38938: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Feb  5 16:29:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.161.172
description:
Feb  5 16:29:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.161.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.150.100.181
description:
Feb  5 16:30:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.150.100.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.233.141.103
description:
[2025-02-05 16:29:56 +0100] info [webmaild] 201.233.141.103 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.23.47.26
description:
[2025-02-05 16:29:58 +0100] info [webmaild] 31.23.47.26 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.113.32
description:
[2025-02-05 16:30:26 +0100] info [webmaild] 45.163.113.32 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 129.222.191.130
description:
[2025-02-05 16:30:29 +0100] info [webmaild] 129.222.191.130 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-05 16:31:23 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:25021: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.82.20.241
description:
Feb  5 16:31:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.82.20.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
description:
2025-02-05 16:31:04 dovecot_plain authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:64110: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  5 16:31:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
description:
Feb  5 16:32:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.214
description:
2025-02-05 16:32:06 dovecot_login authenticator failed for ([61.185.226.214]) [61.185.226.214]:55908: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
description:
2025-02-05 16:32:11 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:50126: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
description:
2025-02-05 16:32:13 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:38224: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.173.82.198
description:
Feb  5 16:32:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.173.82.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.82.198
description:
2025-02-05 16:32:32 dovecot_plain authenticator failed for ([222.173.82.198]) [222.173.82.198]:32094: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.214
description:
Feb  5 16:32:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
description:
2025-02-05 16:32:06 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:47647: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
description:
Feb  5 16:32:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Feb  5 16:32:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-02-05 16:32:35 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:44112: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.121.214.105
description:
2025-02-05 16:31:55 dovecot_login authenticator failed for ([176.121.214.105]) [176.121.214.105]:47055: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
description:
Feb  5 16:32:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
description:
2025-02-05 16:32:35 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:34080: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.148.23.138
description:
[2025-02-05 16:32:39 +0100] info [webmaild] 103.148.23.138 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.121.214.105
description:
Feb  5 16:31:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.121.214.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
description:
Feb  5 16:32:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.63.135
description:
[2025-02-05 16:33:09 +0100] info [webmaild] 177.39.63.135 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.57.151.16
description:
[2025-02-05 16:33:19 +0100] info [webmaild] 190.57.151.16 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 16:33:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.196.88
description:
[2025-02-05 16:32:47 +0100] info [webmaild] 170.245.196.88 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 16:34:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.20.181.253
description:
Feb  5 16:34:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.20.181.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.20.181.253
description:
2025-02-05 16:34:14 dovecot_plain authenticator failed for 78-20-181-253.access.telenet.be (slatancot) [78.20.181.253]:40756: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.122.67.11
description:
[2025-02-05 16:35:08 +0100] info [webmaild] 62.122.67.11 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.168.2.19
description:
[2025-02-05 16:35:29 +0100] info [webmaild] 105.168.2.19 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.90.110.251
description:
2025-02-05 16:35:10 dovecot_login authenticator failed for ppp-61-90-110-251.revip.asianet.co.th [61.90.110.251]:34956: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.74.227.57
description:
[2025-02-05 16:35:36 +0100] info [webmaild] 196.74.227.57 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.90.110.251
description:
Feb  5 16:35:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.90.110.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  5 16:35:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Feb  5 16:35:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-02-05 16:35:22 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:49542: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-05 16:35:32 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:34420: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.153
description:
Feb  5 16:35:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.153
description:
2025-02-05 16:35:38 dovecot_login authenticator failed for ([104.241.236.153]) [104.241.236.153]:52239: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
description:
Feb  5 16:36:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
description:
2025-02-05 16:36:09 dovecot_plain authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:57358: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Feb  5 16:36:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-05 16:36:11 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:23262: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
description:
Feb  5 16:36:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-05 16:36:30 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:45822: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
description:
2025-02-05 16:36:32 dovecot_plain authenticator failed for ([103.93.37.178]) [103.93.37.178]:54504: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-05 16:35:43 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:55310: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.85.114
description:
Feb  5 16:36:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.85.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 16:36:34 dovecot_plain authenticator failed for (58.69.17.18.pldt.net) [58.69.17.18]:42446: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
description:
2025-02-05 16:36:35 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:56128: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  5 16:36:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.85.114
description:
2025-02-05 16:36:13 dovecot_plain authenticator failed for ([189.109.76.190]) [186.200.85.114]:46208: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-02-05 16:36:15 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:44141: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Feb  5 16:36:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-05 16:35:55 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:4860: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
description:
2025-02-05 16:36:10 dovecot_plain authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:49298: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.252.222.82
description:
Feb  5 16:36:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.252.222.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 16:36:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.25.45.251
description:
[2025-02-05 16:36:01 +0100] info [webmaild] 38.25.45.251 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Feb  5 16:36:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-02-05 16:36:19 dovecot_plain authenticator failed for (57.252.223.60.adsl-pool.sx.cn) [60.223.252.57]:57051: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
description:
Feb  5 16:36:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
description:
Feb  5 16:36:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-02-05 16:36:34 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:49172: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  5 16:35:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  5 16:35:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Feb  5 16:36:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.252.222.82
description:
2025-02-05 16:36:25 dovecot_plain authenticator failed for ([58.252.222.82]) [58.252.222.82]:45400: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
description:
2025-02-05 16:37:33 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:43772: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.118.248.70
description:
Feb  5 16:36:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.118.248.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
description:
2025-02-05 16:36:58 dovecot_plain authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:57020: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.124.54.6
description:
2025-02-05 16:37:04 dovecot_login authenticator failed for ([179.124.54.6]) [179.124.54.6]:49792: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Feb  5 16:37:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
description:
Feb  5 16:37:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-02-05 16:37:28 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:36732: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
description:
Feb  5 16:37:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
description:
2025-02-05 16:36:50 dovecot_plain authenticator failed for data.autofrant.ru (nosproloof) [151.248.116.230]:60860: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Feb  5 16:37:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-02-05 16:37:31 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:51900: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.156.203
description:
Feb  5 16:37:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.156.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
description:
2025-02-05 16:37:38 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:56142: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.124.54.6
description:
Feb  5 16:37:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.124.54.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-02-05 16:37:28 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:49535: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.237.108
description:
2025-02-05 16:37:31 dovecot_plain authenticator failed for ([218.147.237.108]) [218.147.237.108]:38012: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-02-05 16:37:31 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:60306: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
description:
2025-02-05 16:37:35 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:55183: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.18
description:
2025-02-05 16:37:36 dovecot_plain authenticator failed for ([125.90.72.18]) [125.90.72.18]:44242: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-02-05 16:37:37 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:57359: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Feb  5 16:36:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
description:
Feb  5 16:37:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.18
description:
Feb  5 16:37:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-05 16:37:36 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:56764: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-02-05 16:37:36 dovecot_plain authenticator failed for ([36.135.125.196]) [36.135.125.196]:43872: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  5 16:37:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
description:
Feb  5 16:37:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Feb  5 16:37:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Feb  5 16:37:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-02-05 16:37:30 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:33936: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
description:
Feb  5 16:37:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.19.225
description:
Feb  5 16:37:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.19.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
description:
Feb  5 16:37:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.248.70
description:
2025-02-05 16:36:48 dovecot_plain authenticator failed for p173071-obmd01.osaka.ocn.ne.jp [61.118.248.70]:47464: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.154.245
description:
Feb  5 16:37:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.154.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.197.237.177
description:
Feb  5 16:37:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.197.237.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.225.19
description:
Feb  5 16:37:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.225.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  5 16:37:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
description:
2025-02-05 16:37:34 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:53418: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
description:
Feb  5 16:37:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Feb  5 16:37:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.245.66
description:
Feb  5 16:37:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.245.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-02-05 16:37:30 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:34512: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.245.66
description:
2025-02-05 16:37:32 dovecot_plain authenticator failed for ([120.238.245.66]) [120.238.245.66]:38673: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Feb  5 16:37:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.156.203
description:
2025-02-05 16:37:39 dovecot_plain authenticator failed for ([120.197.156.203]) [120.197.156.203]:33420: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-02-05 16:37:30 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:3652: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
description:
Feb  5 16:37:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.225.19
description:
2025-02-05 16:37:34 dovecot_plain authenticator failed for ([220.80.225.19]) [220.80.225.19]:50177: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  5 16:37:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-02-05 16:37:39 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:2803: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Feb  5 16:37:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.51.213
description:
Feb  5 16:36:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.51.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Feb  5 16:37:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Feb  5 16:37:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  5 16:37:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Feb  5 16:37:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-02-05 16:37:29 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:50990: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-02-05 16:37:30 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:46506: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-05 16:37:38 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:57504: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-02-05 16:37:38 dovecot_plain authenticator failed for ([80.233.77.136]) [80.233.77.136]:28307: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.154.245
description:
2025-02-05 16:37:26 dovecot_plain authenticator failed for ([94.202.154.245]) [94.202.154.245]:53185: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-02-05 16:37:27 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:39006: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.197.237.177
description:
2025-02-05 16:37:30 dovecot_plain authenticator failed for (177.237.197.116.unknown.m1.com.sg) [116.197.237.177]:43312: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Feb  5 16:37:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
description:
2025-02-05 16:37:33 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:58618: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Feb  5 16:37:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Feb  5 16:37:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.24.87.10
description:
Feb  5 16:37:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.24.87.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.87.10
description:
2025-02-05 16:37:32 dovecot_plain authenticator failed for ([183.24.87.10]) [183.24.87.10]:48396: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
description:
2025-02-05 16:37:37 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:38640: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
description:
Feb  5 16:37:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.28.237
description:
Feb  5 16:37:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.28.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-02-05 16:37:32 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:58998: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.241.177
description:
Feb  5 16:37:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.241.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
description:
2025-02-05 16:37:29 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:38206: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Feb  5 16:37:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
description:
2025-02-05 16:37:25 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:52498: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  5 16:37:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Feb  5 16:37:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-02-05 16:37:28 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:58577: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.237.108
description:
Feb  5 16:37:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
description:
2025-02-05 16:37:29 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:34578: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Feb  5 16:37:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.241.177
description:
2025-02-05 16:37:38 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:38784: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.28.237
description:
2025-02-05 16:37:26 dovecot_plain authenticator failed for host-79-21-28-237.retail.telecomitalia.it [79.21.28.237]:56096: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-02-05 16:37:27 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:36026: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-05 16:37:29 dovecot_plain authenticator failed for ([177.6.235.62]) [177.6.235.62]:52837: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-02-05 16:37:30 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:58012: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
description:
Feb  5 16:37:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.183
description:
Feb  5 16:37:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-05 16:37:39 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:34797: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.122.141
domain: iric.us
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.248.116.230
description:
Feb  5 16:36:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.248.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-02-05 16:36:55 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:58190: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Feb  5 16:37:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-02-05 16:37:29 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:53477: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
description:
Feb  5 16:37:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
description:
2025-02-05 16:37:59 dovecot_plain authenticator failed for ([61.184.119.61]) [61.184.119.61]:60366: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
description:
2025-02-05 16:38:17 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:41660: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Feb  5 16:37:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.230
description:
2025-02-05 16:37:44 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.230]:42245: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.243.187
description:
Feb  5 16:37:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.243.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  5 16:37:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-05 16:37:48 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:57389: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-02-05 16:37:53 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:53389: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Feb  5 16:37:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-02-05 16:37:56 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:42658: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.156.63.212
description:
Feb  5 16:37:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.156.63.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.230
description:
Feb  5 16:37:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-02-05 16:37:44 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:47374: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
description:
2025-02-05 16:37:46 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:39457: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Feb  5 16:37:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-02-05 16:37:49 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:41882: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-02-05 16:38:32 dovecot_login authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:49910: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.241
description:
Feb  5 16:37:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-02-05 16:37:47 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:48616: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 16:37:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.125.64.126
description:
2025-02-05 16:37:54 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:58388: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.157.134
description:
Feb  5 16:37:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.157.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Feb  5 16:38:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.63.212
description:
2025-02-05 16:37:43 dovecot_plain authenticator failed for ([202.156.63.212]) [202.156.63.212]:39068: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
description:
Feb  5 16:37:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Feb  5 16:37:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-02-05 16:38:12 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:42582: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
description:
2025-02-05 16:37:47 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:34636: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Feb  5 16:37:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-02-05 16:37:53 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:39760: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.195.198
description:
2025-02-05 16:38:05 dovecot_plain authenticator failed for ([221.10.195.198]) [221.10.195.198]:44001: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 16:38:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  5 16:38:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.183
description:
2025-02-05 16:37:42 dovecot_plain authenticator failed for ([27.45.233.183]) [27.45.233.183]:36017: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-02-05 16:37:45 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:54100: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
description:
2025-02-05 16:37:45 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:51314: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-05 16:37:49 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:42392: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-02-05 16:37:51 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:55936: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
description:
2025-02-05 16:37:56 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:53928: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-02-05 16:38:00 dovecot_plain authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:54652: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.14.155
description:
Feb  5 16:38:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.14.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.102.179
description:
Feb  5 16:37:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.102.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Feb  5 16:37:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.24.93
description:
Feb  5 16:37:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.24.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Feb  5 16:37:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
description:
2025-02-05 16:37:47 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:37512: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.117.226
description:
2025-02-05 16:37:48 dovecot_plain authenticator failed for ([103.95.156.1]) [42.1.117.226]:54657: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.157.134
description:
2025-02-05 16:38:01 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.157.134]:58519: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-02-05 16:38:08 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:43967: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  5 16:37:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-05 16:37:43 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:54298: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
description:
Feb  5 16:37:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.1.117.226
description:
Feb  5 16:37:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.1.117.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Feb  5 16:37:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Feb  5 16:37:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.75.27
description:
[2025-02-05 16:38:10 +0100] info [webmaild] 38.156.75.27 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
description:
Feb  5 16:37:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
description:
Feb  5 16:37:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Feb  5 16:37:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
description:
Feb  5 16:37:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 16:38:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.192.154
description:
Feb  5 16:38:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.192.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
description:
2025-02-05 16:38:35 dovecot_login authenticator failed for (200-153-56-145.sgsnet.com.br) [187.92.192.154]:47412: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.55.59
description:
Feb  5 16:37:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.55.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.55.59
description:
2025-02-05 16:37:43 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:34760: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
description:
2025-02-05 16:37:46 dovecot_plain authenticator failed for ([103.194.243.187]) [103.194.243.187]:56914: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
description:
Feb  5 16:37:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-02-05 16:37:53 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:47882: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
description:
Feb  5 16:38:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.39.230.40
description:
2025-02-05 16:37:43 dovecot_plain authenticator failed for ([118.39.230.40]) [118.39.230.40]:2626: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.125.64.126
description:
Feb  5 16:37:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.125.64.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-05 16:38:14 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:28937: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-02-05 16:37:55 dovecot_plain authenticator failed for ([60.247.92.186]) [60.247.92.186]:42820: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Feb  5 16:37:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.161
description:
Feb  5 16:37:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.39.230.40
description:
Feb  5 16:37:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.39.230.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
description:
2025-02-05 16:37:41 dovecot_plain authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:34586: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-02-05 16:37:44 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:53670: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
description:
2025-02-05 16:37:46 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:55368: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Feb  5 16:37:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.195.198
description:
Feb  5 16:38:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.195.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Feb  5 16:38:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.241
description:
2025-02-05 16:37:43 dovecot_plain authenticator failed for (mobile-166-195-196-241.mycingular.net) [166.195.196.241]:43388: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
description:
2025-02-05 16:37:50 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:47771: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
description:
2025-02-05 16:37:54 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:42736: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
description:
Feb  5 16:38:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Feb  5 16:38:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
description:
2025-02-05 16:37:41 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:52232: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
description:
Feb  5 16:37:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.225.106.212
description:
[2025-02-05 16:37:44 +0100] info [webmaild] 200.225.106.212 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-02-05 16:37:57 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:60022: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.241.70
description:
[2025-02-05 16:38:12 +0100] info [webmaild] 138.219.241.70 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.14.155
description:
2025-02-05 16:38:21 dovecot_login authenticator failed for ([183.237.14.155]) [183.237.14.155]:47383: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.161
description:
2025-02-05 16:37:43 dovecot_plain authenticator failed for ([121.202.154.161]) [121.202.154.161]:36227: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
description:
2025-02-05 16:38:21 dovecot_login authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:51061: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.102.179
description:
2025-02-05 16:37:42 dovecot_plain authenticator failed for ([183.238.102.179]) [183.238.102.179]:57145: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Feb  5 16:37:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.24.93
description:
2025-02-05 16:37:44 dovecot_plain authenticator failed for ([218.149.24.93]) [218.149.24.93]:45798: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
description:
Feb  5 16:37:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.202.10.120
description:
[2025-02-05 16:38:42 +0100] info [webmaild] 154.202.10.120 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
description:
Feb  5 16:39:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
description:
2025-02-05 16:39:25 dovecot_login authenticator failed for ([103.170.225.80]) [103.170.225.80]:51362: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Feb  5 16:39:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-02-05 16:39:35 dovecot_plain authenticator failed for (warriceass) [185.168.173.87]:57250: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Feb  5 16:39:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-02-05 16:39:37 dovecot_login authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2584: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
description:
Feb  5 16:40:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.136.22
description:
[2025-02-05 16:40:24 +0100] info [webmaild] 45.227.136.22 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-02-05 16:40:30 dovecot_plain authenticator failed for ([78.134.19.99]) [78.134.19.99]:56367: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.230.214.243
description:
Feb  5 16:40:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.230.214.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Feb  5 16:39:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
description:
Feb  5 16:40:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Feb  5 16:40:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 5.160.247.200
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-40.5.160.247.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
description:
2025-02-05 16:40:20 dovecot_plain authenticator failed for ([124.246.94.219]) [124.246.94.219]:47710: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.213.164.27
description:
Feb  5 16:40:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.213.164.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.148.129.9
description:
Feb  5 16:40:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.148.129.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
description:
Feb  5 16:40:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.243.187
description:
Feb  5 16:40:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.243.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Feb  5 16:40:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
description:
2025-02-05 16:40:36 dovecot_plain authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:48736: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Feb  5 16:40:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  5 16:40:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
description:
2025-02-05 16:40:34 dovecot_plain authenticator failed for ([103.194.243.187]) [103.194.243.187]:34559: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
description:
Feb  5 16:40:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Feb  5 16:40:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.230.214.243
description:
Feb  5 16:40:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.230.214.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Feb  5 16:40:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.115.223.182
description:
[2025-02-05 16:40:47 +0100] info [webmaild] 102.115.223.182 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
description:
2025-02-05 16:40:49 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:35015: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.47.172.253
description:
Feb  5 16:40:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.47.172.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-05 16:40:42 dovecot_plain authenticator failed for ([116.86.99.64]) [116.86.99.64]:57744: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-02-05 16:40:49 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:39524: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.178.158
description:
2025-02-05 16:41:04 dovecot_plain authenticator failed for (200-168-190-25.customer.tdatabrasil.net.br) [189.56.178.158]:57287: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Feb  5 16:40:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
description:
Feb  5 16:40:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Feb  5 16:40:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.12.78.64
description:
[2025-02-05 16:40:50 +0100] info [webmaild] 189.12.78.64 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.178.158
description:
Feb  5 16:41:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.178.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.70.93.238
description:
[2025-02-05 16:41:23 +0100] info [webmaild] 177.70.93.238 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.213.164.27
description:
2025-02-05 16:40:42 dovecot_plain authenticator failed for ([1.213.164.27]) [1.213.164.27]:39886: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
description:
Feb  5 16:40:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
description:
Feb  5 16:40:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
description:
2025-02-05 16:40:57 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:39089: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Feb  5 16:41:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Feb  5 16:40:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-02-05 16:42:07 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:52838: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  5 16:42:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
description:
Feb  5 16:42:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.95.130.118
description:
Feb  5 16:41:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.95.130.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Feb  5 16:42:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.95.223.139
description:
Feb  5 16:42:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.95.223.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Feb  5 16:42:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.209.221.7
description:
Feb  5 16:42:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.209.221.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.93.220
description:
Feb  5 16:42:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.93.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-05 16:42:30 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:60381: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Feb  5 16:42:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  5 16:41:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.204.112.147
description:
Feb  5 16:42:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.204.112.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.7.135.13
description:
Feb  5 16:42:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.7.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Feb  5 16:42:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.245.67
description:
Feb  5 16:42:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.245.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
description:
Feb  5 16:42:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.159.71.249
description:
Feb  5 16:41:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.159.71.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
description:
Feb  5 16:42:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.87.70
description:
Feb  5 16:42:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-05 16:42:19 dovecot_plain authenticator failed for (host-80-241-253-238.customer.magticom.ge) [2.57.219.2]:57972: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-05 16:41:59 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (preafters) [176.37.212.85]:33517: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Feb  5 16:42:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.204.112.147
description:
2025-02-05 16:42:07 dovecot_plain authenticator failed for ([163.204.112.147]) [163.204.112.147]:37274: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
description:
2025-02-05 16:42:15 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:40924: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.91.133
description:
Feb  5 16:42:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.91.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  5 16:41:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Feb  5 16:41:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.247.174
description:
Feb  5 16:42:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.247.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.7.135.13
description:
2025-02-05 16:42:21 dovecot_plain authenticator failed for ([119.7.135.13]) [119.7.135.13]:45984: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.34.28
description:
Feb  5 16:42:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.34.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 16:41:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.218.132.27
description:
Feb  5 16:41:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.218.132.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.64.209.11
description:
Feb  5 16:42:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.64.209.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.245.67
description:
2025-02-05 16:42:39 dovecot_plain authenticator failed for ([120.238.245.67]) [120.238.245.67]:45701: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Feb  5 16:41:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-02-05 16:42:00 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:51582: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  5 16:42:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Feb  5 16:42:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
description:
2025-02-05 16:42:42 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:47738: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  5 16:43:05 ait sshd[668458]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.20
description:
Feb  5 16:43:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.125.34.83
description:
Feb  5 16:43:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.125.34.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
description:
Feb  5 16:43:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.34.28
description:
Feb  5 16:42:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.34.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.236.91.93
description:
Feb  5 16:43:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.236.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
description:
2025-02-05 16:43:32 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:44827: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
description:
Feb  5 16:42:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-02-05 16:42:52 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:41894: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-02-05 16:42:52 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:45946: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.235.225.107
description:
[2025-02-05 16:42:54 +0100] info [webmaild] 91.235.225.107 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.76.95.126
description:
Feb  5 16:42:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.76.95.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-02-05 16:43:17 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:51949: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.241.218
description:
[2025-02-05 16:43:25 +0100] info [webmaild] 177.84.241.218 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Feb  5 16:42:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Feb  5 16:42:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.209.141.145
description:
Feb  5 16:42:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.209.141.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Feb  5 16:43:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.236.91.93
description:
2025-02-05 16:43:22 dovecot_plain authenticator failed for ([42.236.91.93]) [42.236.91.93]:28242: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.198.91.133
description:
Feb  5 16:42:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.198.91.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.93.220
description:
Feb  5 16:42:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.93.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Feb  5 16:43:05 ait sshd[668458]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.28.65.11
description:
[2025-02-05 16:43:36 +0100] info [webmaild] 37.28.65.11 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.61.25
description:
[2025-02-05 16:44:01 +0100] info [webmaild] 157.100.61.25 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Feb  5 16:44:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.210
description:
Feb  5 16:44:25 ait sshd[669183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.210  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.228.174
description:
Feb  5 16:44:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.228.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.228.174
description:
2025-02-05 16:44:19 dovecot_plain authenticator failed for (abts-tn-static-174.228.165.122.airtelbroadband.in) [122.165.228.174]:42384: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-02-05 16:44:21 dovecot_login authenticator failed for ([141.94.18.69]) [141.94.18.69]:36988: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.210
description:
Feb  5 16:44:25 ait sshd[669183]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.89.60.158
description:
Feb  5 16:44:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.89.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
description:
2025-02-05 16:44:41 dovecot_login authenticator failed for ([124.89.60.158]) [124.89.60.158]:38338: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.125.34.83
description:
Feb  5 16:43:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.125.34.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
description:
Feb  5 16:44:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
description:
2025-02-05 16:44:10 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:58324: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
description:
Feb  5 16:44:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.200.111
description:
[2025-02-05 16:45:31 +0100] info [webmaild] 186.158.200.111 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.210
description:
Feb  5 16:44:43 ait sshd[669183]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.202
description:
Feb  5 16:44:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-02-05 16:45:05 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:11526: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Feb  5 16:45:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.123.199.111
description:
Feb  5 16:45:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.123.199.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
description:
Feb  5 16:44:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.210
description:
Feb  5 16:44:46 ait sshd[669183]: error: maximum authentication attempts exceeded for root from 218.92.0.210 port 45044 ssh2 [preauth]


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 116.118.51.209
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-44.116.118.51.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Feb  5 16:45:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.19.176
description:
Feb  5 16:45:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.19.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.91.178.116
description:
Feb  5 16:44:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.91.178.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Feb  5 16:44:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Feb  5 16:45:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.240.101.222
description:
Feb  5 16:45:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.240.101.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 16:45:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.19.176
description:
Feb  5 16:45:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.19.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
description:
Feb  5 16:45:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.48
description:
[2025-02-05 16:46:07 +0100] info [webmaild] 213.230.87.48 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Feb  5 16:45:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-02-05 16:45:46 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:53478: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-02-05 16:45:56 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:57170: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
description:
2025-02-05 16:46:37 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:53703: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Feb  5 16:45:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.247.49.232
description:
[2025-02-05 16:46:00 +0100] info [webmaild] 186.247.49.232 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Feb  5 16:46:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Feb  5 16:45:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
description:
2025-02-05 16:45:51 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:34647: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.105.129.93
description:
[2025-02-05 16:46:39 +0100] info [webmaild] 179.105.129.93 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Feb  5 16:46:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-02-05 16:46:49 dovecot_login authenticator failed for ([185.168.173.87]) [185.168.173.87]:55982: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.193.187.205
description:
[2025-02-05 16:48:27 +0100] info [webmaild] 186.193.187.205 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Feb  5 16:48:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-02-05 16:48:27 dovecot_login authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:46052: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-02-05 16:48:36 dovecot_login authenticator failed for ([151.83.71.207]) [151.83.71.207]:33128: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.98.242.18
description:
[2025-02-05 16:47:58 +0100] info [webmaild] 92.98.242.18 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Feb  5 16:48:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
description:
Feb  5 16:49:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
description:
2025-02-05 16:49:35 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:40431: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.83.9.138
description:
Feb  5 16:49:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.83.9.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.134.10.18
description:
2025-02-05 16:49:36 dovecot_plain authenticator failed for (188x134x10x18.static-business.spb.ertelecom.ru) [188.134.10.18]:58176: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
description:
Feb  5 16:49:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.9.138
description:
2025-02-05 16:49:38 dovecot_plain authenticator failed for ([103.83.9.138]) [103.83.9.138]:58056: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
description:
Feb  5 16:49:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.117.197.238
description:
2025-02-05 16:49:34 dovecot_plain authenticator failed for net-109-117-197-238.cust.vodafonedsl.it [109.117.197.238]:45522: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-02-05 16:49:36 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:36986: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
description:
2025-02-05 16:49:38 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:38539: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.141.121.230
description:
[2025-02-05 16:48:44 +0100] info [webmaild] 102.141.121.230 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-02-05 16:49:10 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:42082: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Feb  5 16:49:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
description:
Feb  5 16:49:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
description:
Feb  5 16:49:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
description:
Feb  5 16:49:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.20.86
description:
[2025-02-05 16:49:19 +0100] info [webmaild] 45.229.20.86 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-02-05 16:49:35 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:33138: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.138
description:
2025-02-05 16:49:41 dovecot_plain authenticator failed for ([119.62.184.138]) [119.62.184.138]:51945: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.138
description:
Feb  5 16:49:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
description:
2025-02-05 16:49:41 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:7783: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.117.197.238
description:
Feb  5 16:49:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.117.197.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.44.165
description:
Feb  5 16:49:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.44.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  5 16:49:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-05 16:49:39 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:54968: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  5 16:49:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
description:
2025-02-05 16:49:35 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:36225: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
description:
2025-02-05 16:49:37 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:44238: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
description:
2025-02-05 16:49:37 dovecot_plain authenticator failed for ([49.245.44.165]) [49.245.44.165]:32994: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
description:
2025-02-05 16:49:27 dovecot_plain authenticator failed for ([120.197.10.46]) [120.197.10.46]:48192: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.134.10.18
description:
Feb  5 16:49:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.134.10.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
description:
Feb  5 16:49:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-02-05 16:49:48 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:63866: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Feb  5 16:49:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-02-05 16:49:52 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:54704: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
description:
2025-02-05 16:50:27 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:46847: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.174.35
description:
Feb  5 16:49:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.174.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.82.125.126
description:
[2025-02-05 16:50:32 +0100] info [webmaild] 201.82.125.126 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Feb  5 16:49:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.175.194
description:
2025-02-05 16:49:48 dovecot_plain authenticator failed for ([183.56.179.201]) [119.123.175.194]:47664: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
description:
Feb  5 16:50:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
description:
2025-02-05 16:50:41 dovecot_login authenticator failed for ([91.239.23.149]) [91.239.23.149]:43122: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-02-05 16:49:49 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:45684: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Feb  5 16:49:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-02-05 16:50:03 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:16738: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
description:
2025-02-05 16:50:36 dovecot_login authenticator failed for ([61.51.81.78]) [61.51.81.78]:57526: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
description:
Feb  5 16:49:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-02-05 16:49:52 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:49432: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
description:
2025-02-05 16:49:54 dovecot_plain authenticator failed for ([122.186.174.35]) [122.186.174.35]:38786: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-02-05 16:49:56 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:46746: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  5 16:49:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Feb  5 16:49:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
description:
Feb  5 16:49:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
description:
Feb  5 16:50:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
description:
2025-02-05 16:49:52 dovecot_plain authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:43525: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-02-05 16:50:00 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:45436: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-02-05 16:50:10 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:45730: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
description:
Feb  5 16:49:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
description:
2025-02-05 16:49:54 dovecot_plain authenticator failed for ([123.129.245.249]) [123.129.245.249]:44150: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-02-05 16:49:54 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:36944: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Feb  5 16:50:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
description:
Feb  5 16:50:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.223.58
description:
Feb  5 16:49:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-02-05 16:49:52 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:40608: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
description:
Feb  5 16:49:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Feb  5 16:49:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.223.58
description:
2025-02-05 16:49:44 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.223.58]:58169: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Feb  5 16:49:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Feb  5 16:49:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.18.126.17
description:
Feb  5 16:50:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.18.126.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Feb  5 16:49:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-02-05 16:49:56 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:47246: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.171.195.70
description:
Feb  5 16:50:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.171.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-02-05 16:50:13 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:37106: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
description:
Feb  5 16:50:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.18.126.17
description:
2025-02-05 16:50:34 dovecot_login authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:44081: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-05 16:49:46 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:47898: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-02-05 16:49:47 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:24681: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
description:
2025-02-05 16:49:49 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:59822: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-02-05 16:49:52 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:60587: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
description:
2025-02-05 16:49:53 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:50277: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
description:
2025-02-05 16:50:06 dovecot_plain authenticator failed for ([216.171.195.70]) [216.171.195.70]:39292: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Feb  5 16:50:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Feb  5 16:49:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-02-05 16:49:48 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:60251: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
description:
Feb  5 16:49:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.123.175.194
description:
Feb  5 16:49:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.123.175.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Feb  5 16:49:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Feb  5 16:49:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.216.44.139
description:
[2025-02-05 16:51:01 +0100] info [webmaild] 186.216.44.139 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.21.141.54
description:
Feb  5 16:50:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.21.141.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.183
description:
Feb  5 16:50:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.21.141.54
description:
2025-02-05 16:50:53 dovecot_login authenticator failed for ([125.21.141.54]) [125.21.141.54]:59375: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
description:
2025-02-05 16:50:55 dovecot_login authenticator failed for ([195.222.57.183]) [195.222.57.183]:52892: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.183.140.218
description:
[2025-02-05 16:51:28 +0100] info [webmaild] 103.183.140.218 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.163.99
description:
Feb  5 16:50:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.163.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.163.99
description:
2025-02-05 16:50:46 dovecot_login authenticator failed for ([117.253.163.99]) [117.253.163.99]:58005: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Feb  5 16:50:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-02-05 16:50:49 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (paracke) [92.244.126.105]:49912: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Feb  5 16:52:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
description:
2025-02-05 16:52:41 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:43064: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-02-05 16:52:33 dovecot_login authenticator failed for ([114.108.126.227]) [114.108.126.227]:55620: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-02-05 16:52:12 dovecot_login authenticator failed for ([197.231.129.154]) [197.231.129.154]:59330: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.237.108
description:
Feb  5 16:52:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Feb  5 16:52:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Feb  5 16:52:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.237.108
description:
2025-02-05 16:52:17 dovecot_login authenticator failed for ([218.147.237.108]) [218.147.237.108]:54934: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-02-05 16:52:27 dovecot_login authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:44153: 535 Incorrect authentication data (set_id=21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.189.151
description:
Feb  5 16:52:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.189.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.20.204.124
description:
[2025-02-05 16:51:58 +0100] info [webmaild] 160.20.204.124 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-52.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Feb  5 16:52:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-02-05 16:52:59 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:57844: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.199.35
description:
[2025-02-05 16:53:19 +0100] info [webmaild] 170.233.199.35 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
description:
Feb  5 16:52:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
description:
2025-02-05 16:52:46 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:33448: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.158.215
description:
Feb  5 16:52:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.158.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.158.215
description:
2025-02-05 16:52:53 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:60125: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 16:53:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.216.46.211
description:
[2025-02-05 16:54:21 +0100] info [webmaild] 102.216.46.211 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.120.245.111
description:
[2025-02-05 16:53:48 +0100] info [webmaild] 190.120.245.111 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.161.84
description:
[2025-02-05 16:54:53 +0100] info [webmaild] 170.254.161.84 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-02-05 16:55:05 dovecot_login authenticator failed for ([175.117.144.158]) [175.117.144.158]:36946: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.136.24
description:
Feb  5 16:55:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.136.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
description:
2025-02-05 16:55:19 dovecot_login authenticator failed for ([218.206.136.24]) [218.206.136.24]:40200: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.145
description:
Feb  5 16:55:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
description:
2025-02-05 16:55:35 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:53737: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Feb  5 16:55:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.1.148.18
description:
[2025-02-05 16:56:18 +0100] info [webmaild] 197.1.148.18 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.86.250.17
description:
[2025-02-05 16:55:49 +0100] info [webmaild] 187.86.250.17 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 16:56:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.251.57.157
description:
Feb  5 16:55:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.251.57.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.75.179.106
description:
Feb  5 16:56:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.75.179.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.179.106
description:
2025-02-05 16:56:06 dovecot_login authenticator failed for ([222.75.179.106]) [222.75.179.106]:53155: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.57.157
description:
2025-02-05 16:55:48 dovecot_login authenticator failed for (157.57.251.198.in-addr.arpa) [198.251.57.157]:40064: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-02-05 16:56:57 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:57998: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.100.69.116
description:
[2025-02-05 16:57:00 +0100] info [webmaild] 189.100.69.116 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 83.221.186.229
description:
[2025-02-05 16:57:32 +0100] info [webmaild] 83.221.186.229 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Feb  5 16:56:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Feb  5 16:57:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-02-05 16:57:07 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:39080: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.98.62.18
description:
[2025-02-05 16:58:15 +0100] info [webmaild] 179.98.62.18 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.7.225.113
description:
2025-02-05 16:58:28 dovecot_plain authenticator failed for (113.225.7.186.f.dyn.claro.net.do) [186.7.225.113]:53276: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.208
description:
Feb  5 16:58:29 ait sshd[675888]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.208 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.208
description:
Feb  5 16:58:29 ait sshd[675888]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.208  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.7.225.113
description:
Feb  5 16:58:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.7.225.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-02-05 16:58:43 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:54190: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  5 16:59:31 ait sshd[676289]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.174.90
description:
Feb  5 16:59:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.174.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.0.16.82
description:
[2025-02-05 16:59:34 +0100] info [webmaild] 102.0.16.82 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.208
description:
Feb  5 16:58:47 ait sshd[675888]: error: maximum authentication attempts exceeded for root from 218.92.0.208 port 12150 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-05 16:59:27 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (imyropier) [91.56.31.167]:59983: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  5 16:59:31 ait sshd[676289]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  5 16:59:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
description:
2025-02-05 16:59:37 dovecot_plain authenticator failed for (90.174.34.58.broad.xw.sh.dynamic.163data.com.cn) [58.34.174.90]:33374: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Feb  5 16:58:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.208
description:
Feb  5 16:58:40 ait sshd[675888]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.208 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.192.47.134
description:
[2025-02-05 16:58:45 +0100] info [webmaild] 186.192.47.134 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.121.59
description:
[2025-02-05 17:00:07 +0100] info [webmaild] 45.188.121.59 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
description:
Feb  5 17:00:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-02-05 16:59:56 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:43264: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
description:
2025-02-05 17:00:33 dovecot_plain authenticator failed for ([222.132.167.110]) [222.132.167.110]:46142: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
description:
Feb  5 16:59:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
description:
2025-02-05 16:59:43 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:42115: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Feb  5 16:59:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.66.62.86
description:
2025-02-05 16:59:57 dovecot_plain authenticator failed for ip5b423e56.dynamic.kabel-deutschland.de [91.66.62.86]:39308: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.66.62.86
description:
Feb  5 16:59:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.66.62.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-02-05 17:00:53 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:36312: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Feb  5 17:00:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 141.101.229.125
description:
[2025-02-05 17:00:51 +0100] info [webmaild] 141.101.229.125 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Feb  5 17:01:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-02-05 17:01:04 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:15455: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.247.249.10
description:
Feb  5 17:00:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.247.249.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.247.249.10
description:
2025-02-05 17:00:48 dovecot_login authenticator failed for ([61.247.249.10]) [61.247.249.10]:51722: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.143.14
description:
[2025-02-05 17:01:20 +0100] info [webmaild] 45.236.143.14 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Feb  5 17:02:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Feb  5 17:02:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-02-05 17:02:02 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:58682: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Feb  5 17:02:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-02-05 17:02:04 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:59102: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.166.59.194
description:
[2025-02-05 17:02:12 +0100] info [webmaild] 103.166.59.194 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Feb  5 17:02:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-02-05 17:02:15 dovecot_plain authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:52809: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-02-05 17:02:17 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:46450: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.37.159
description:
47.128.37.159 - - [05/Feb/2025:17:03:34 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18448453 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/b612ac?panel=exception" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.37.159


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.203.116
description:
[2025-02-05 17:02:41 +0100] info [webmaild] 45.230.203.116 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 17:03:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.178.210.63
description:
[2025-02-05 17:03:24 +0100] info [webmaild] 178.178.210.63 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
description:
Feb  5 17:03:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.17
description:
2025-02-05 17:03:29 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:33626: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.197.153.25
description:
[2025-02-05 17:03:53 +0100] info [webmaild] 103.197.153.25 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.33.247.159
description:
Feb  5 17:04:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.33.247.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.33.247.159
description:
2025-02-05 17:04:10 dovecot_plain authenticator failed for 92-33-247-159.customers.ownit.se (bendaeous) [92.33.247.159]:35620: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 17:03:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Feb  5 17:03:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-02-05 17:03:45 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:42492: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.227.129
description:
[2025-02-05 17:04:55 +0100] info [webmaild] 37.40.227.129 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.239.159.22
description:
[2025-02-05 17:05:13 +0100] info [webmaild] 45.239.159.22 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
description:
Feb  5 17:06:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
description:
2025-02-05 17:06:21 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:47497: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.142.16.61
description:
[2025-02-05 17:06:22 +0100] info [webmaild] 195.142.16.61 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.51.213
description:
Feb  5 17:06:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.51.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
description:
2025-02-05 17:06:31 dovecot_plain authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:57414: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.57.223.10
description:
[2025-02-05 17:05:53 +0100] info [webmaild] 154.57.223.10 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Feb  5 17:06:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-02-05 17:06:15 dovecot_plain authenticator failed for (abecia) [102.53.15.56]:52575: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
description:
2025-02-05 17:06:47 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:37364: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Feb  5 17:07:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-02-05 17:07:11 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:13107: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.116.50.80
description:
[2025-02-05 17:07:33 +0100] info [webmaild] 179.116.50.80 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-06.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
description:
Feb  5 17:06:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
description:
2025-02-05 17:08:09 dovecot_plain authenticator failed for ([182.135.66.179]) [182.135.66.179]:36084: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Feb  5 17:08:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.131.79
description:
Feb  5 17:08:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.131.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-02-05 17:08:19 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:56833: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-05 17:08:22 dovecot_plain authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:46242: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.198.232
description:
Feb  5 17:08:27 ait sshd[680357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.198.232  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.26.83.215
description:
[2025-02-05 17:08:36 +0100] info [webmaild] 201.26.83.215 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
description:
Feb  5 17:08:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
description:
Feb  5 17:08:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
description:
2025-02-05 17:08:31 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:52649: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 210.1.246.133
description:
[2025-02-05 17:08:02 +0100] info [webmaild] 210.1.246.133 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  5 17:08:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.131.79
description:
2025-02-05 17:08:41 dovecot_plain authenticator failed for ([111.53.131.79]) [111.53.131.79]:39072: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 17:08:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.58.94
description:
2025-02-05 17:08:57 dovecot_plain authenticator failed for ([183.238.58.94]) [183.238.58.94]:60814: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-02-05 17:09:40 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:56168: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Feb  5 17:08:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-02-05 17:08:54 dovecot_plain authenticator failed for ([200.223.192.254]) [200.223.192.254]:47055: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.58.94
description:
Feb  5 17:08:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.58.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.202.8.65
description:
[2025-02-05 17:09:06 +0100] info [webmaild] 154.202.8.65 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Feb  5 17:09:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Feb  5 17:09:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-02-05 17:09:41 dovecot_login authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:51090: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-05 17:09:46 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:37265: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.189.61.162
description:
Feb  5 17:09:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.189.61.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.247.109
description:
Feb  5 17:10:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.78.247.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.171.195.70
description:
Feb  5 17:10:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.171.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.91.140.43
description:
[2025-02-05 17:10:29 +0100] info [webmaild] 197.91.140.43 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.186.98
description:
[2025-02-05 17:09:57 +0100] info [webmaild] 45.177.186.98 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Feb  5 17:10:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-02-05 17:10:06 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:60763: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  5 17:10:08 ait sshd[681310]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 17:10:08 ait sshd[681310]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
description:
2025-02-05 17:10:28 dovecot_plain authenticator failed for ([216.171.195.70]) [216.171.195.70]:52250: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 17:10:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  5 17:09:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.189.61.162
description:
2025-02-05 17:09:53 dovecot_plain authenticator failed for ([61.189.61.162]) [61.189.61.162]:57858: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Feb  5 17:10:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
description:
Feb  5 17:10:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.78.247.109
description:
2025-02-05 17:10:03 dovecot_login authenticator failed for ([41.78.247.109]) [41.78.247.109]:39168: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-02-05 17:10:05 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:4573: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-02-05 17:10:15 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:49882: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
description:
Feb  5 17:10:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
description:
2025-02-05 17:10:19 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:52762: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.164.209.34
description:
[2025-02-05 17:11:03 +0100] info [webmaild] 190.164.209.34 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.88.64.163
description:
2025-02-05 17:11:13 dovecot_plain authenticator failed for ([222.88.64.163]) [222.88.64.163]:52648: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.198.232
description:
Feb  5 17:10:50 ait sshd[681900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.198.232  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.44.20
description:
47.128.44.20 - - [05/Feb/2025:17:10:57 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10303154 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/data/smoke-2019-price.php" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.44.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.88.64.163
description:
Feb  5 17:11:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.88.64.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
description:
Feb  5 17:11:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
description:
2025-02-05 17:11:23 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:55766: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.49.16
description:
[2025-02-05 17:11:32 +0100] info [webmaild] 37.238.49.16 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Feb  5 17:11:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-02-05 17:11:59 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:38550: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.251.100.68
description:
[2025-02-05 17:12:37 +0100] info [webmaild] 41.251.100.68 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
description:
Feb  5 17:11:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 17:11:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
description:
2025-02-05 17:11:48 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:43228: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 17:12:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-02-05 17:12:34 dovecot_login authenticator failed for (187-8-108-170.customer.tdatabrasil.net.br) [189.56.217.183]:51407: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Feb  5 17:14:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
description:
2025-02-05 17:14:14 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:50616: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 17:14:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.199.129
description:
2025-02-05 17:14:40 dovecot_plain authenticator failed for (synest) [89.23.199.129]:35503: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 204.10.194.229
description:
Feb  5 17:13:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 204.10.194.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
description:
Feb  5 17:13:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
description:
2025-02-05 17:13:55 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:33869: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
description:
Feb  5 17:14:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
description:
Feb  5 17:14:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.180.84
description:
Feb  5 17:14:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 204.10.194.229
description:
[2025-02-05 17:14:08 +0100] info [webmaild] 204.10.194.229 - abs22a00002y@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Feb  5 17:14:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-02-05 17:14:27 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:33806: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
description:
2025-02-05 17:14:29 dovecot_plain authenticator failed for ([183.123.27.87]) [183.123.27.87]:42453: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.199.129
description:
Feb  5 17:14:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.199.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 17:13:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.180.84
description:
2025-02-05 17:14:03 dovecot_plain authenticator failed for ([120.238.180.84]) [120.238.180.84]:37464: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-02-05 17:14:10 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:33697: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.119.61.11
description:
[2025-02-05 17:14:01 +0100] info [webmaild] 92.119.61.11 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Feb  5 17:14:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-02-05 17:14:13 dovecot_plain authenticator failed for ([89.175.253.49]) [89.175.253.49]:46822: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Feb  5 17:13:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.10.194.229
description:
2025-02-05 17:13:46 dovecot_plain authenticator failed for ([204.10.194.229]) [204.10.194.229]:52713: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-02-05 17:13:46 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:48012: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-02-05 17:14:46 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:1893: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-05 17:15:32 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:37040: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-05 17:15:37 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:39236: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:dennisbotchway02@gmail.com||WPU:dennisbotchway02@gmail.com||RSV:6.65||T:APACHE||MV:17-15.204.10.194.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Feb  5 17:14:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Feb  5 17:14:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.112.47
description:
[2025-02-05 17:15:12 +0100] info [webmaild] 213.230.112.47 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Feb  5 17:15:32 ait sshd[684174]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  5 17:15:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.135.74
description:
2025-02-05 17:14:59 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:58226: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Feb  5 17:15:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  5 17:15:32 ait sshd[684174]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Feb  5 17:15:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-02-05 17:16:01 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:51106: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.234
description:
Feb  5 17:16:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
description:
2025-02-05 17:16:30 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:50992: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.38.194
description:
47.128.38.194 - - [05/Feb/2025:17:16:01 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13747394 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/60dd31?panel=request" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.38.194


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Feb  5 17:16:23 ait sshd[684629]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Feb  5 17:16:23 ait sshd[684629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 17:16:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 150.107.107.50
description:
[2025-02-05 17:15:48 +0100] info [webmaild] 150.107.107.50 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.234
description:
2025-02-05 17:16:14 dovecot_plain authenticator failed for ([61.185.226.234]) [61.185.226.234]:42782: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.236.222.5
description:
[2025-02-05 17:16:32 +0100] info [webmaild] 176.236.222.5 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.73.233.135
description:
[2025-02-05 17:15:59 +0100] info [webmaild] 189.73.233.135 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
description:
Feb  5 17:16:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-02-05 17:16:49 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:2383: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.233.196
description:
Feb  5 17:17:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.233.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.233.196
description:
2025-02-05 17:17:15 dovecot_plain authenticator failed for p46196-obmd01.osaka.ocn.ne.jp [153.141.233.196]:45191: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Feb  5 17:17:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 17:17:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
description:
2025-02-05 17:17:31 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:49898: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.49.225.218
description:
Feb  5 17:17:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.49.225.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.49.225.218
description:
2025-02-05 17:17:10 dovecot_plain authenticator failed for (161.49.225.218.convergeict.com) [161.49.225.218]:41522: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-02-05 17:17:22 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:33963: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Feb  5 17:16:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
description:
Feb  5 17:17:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Feb  5 17:17:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-02-05 17:17:38 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (intion) [81.237.110.29]:43296: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-02-05 17:17:58 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:55808: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.102.188.188
description:
Feb  5 17:18:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.102.188.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
description:
2025-02-05 17:18:12 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:41632: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-02-05 17:18:15 dovecot_plain authenticator failed for (absobia) [102.53.15.180]:35224: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-02-05 17:18:21 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (amidembean) [81.225.30.107]:59184: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.102.188.188
description:
2025-02-05 17:18:03 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:34379: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Feb  5 17:18:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Feb  5 17:18:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Feb  5 17:18:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
description:
Feb  5 17:18:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Feb  5 17:17:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-02-05 17:18:28 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:47500: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 116.71.102.221
description:
[2025-02-05 17:18:25 +0100] info [webmaild] 116.71.102.221 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.100.123.223
description:
[2025-02-05 17:18:57 +0100] info [webmaild] 191.100.123.223 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 17:19:01 ait sshd[685827]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-02-05 17:19:04 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:46668: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Feb  5 17:19:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-02-05 17:19:16 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:41368: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.245.96.165
description:
[2025-02-05 17:18:45 +0100] info [webmaild] 103.245.96.165 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 17:19:01 ait sshd[685827]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.193.168.8
description:
[2025-02-05 17:19:13 +0100] info [webmaild] 41.193.168.8 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.2.172
description:
Feb  5 17:19:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.2.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.172
description:
2025-02-05 17:19:35 dovecot_plain authenticator failed for ([31.173.2.172]) [31.173.2.172]:36460: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
description:
2025-02-05 17:20:04 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:51182: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.79.249.83
description:
Feb  5 17:20:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.79.249.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.80.11
description:
Feb  5 17:20:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.80.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.46
description:
2025-02-05 17:19:44 dovecot_login authenticator failed for ([91.73.195.46]) [91.73.195.46]:44006: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.145.18
description:
Feb  5 17:19:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.145.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Feb  5 17:20:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-02-05 17:20:02 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:60928: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.160.175
description:
Feb  5 17:20:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.160.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.46
description:
Feb  5 17:19:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
description:
2025-02-05 17:20:27 dovecot_plain authenticator failed for (static-11.80.156.182-tataidc.co.in) [182.156.80.11]:49658: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.237.145.18
description:
2025-02-05 17:19:58 dovecot_plain authenticator failed for ([186.237.145.18]) [186.237.145.18]:54036: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.79.249.83
description:
2025-02-05 17:20:24 dovecot_plain authenticator failed for ([50.79.249.83]) [50.79.249.83]:5531: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
description:
2025-02-05 17:20:31 dovecot_plain authenticator failed for 37-46-160-175.customers.ownit.se [37.46.160.175]:49832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.211.194.58
description:
Feb  5 17:21:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.211.194.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.211.194.58
description:
2025-02-05 17:21:37 dovecot_login authenticator failed for ([60.211.194.58]) [60.211.194.58]:9508: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.136.148.73
description:
[2025-02-05 17:20:54 +0100] info [webmaild] 185.136.148.73 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Feb  5 17:21:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-21.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
description:
Feb  5 17:21:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-02-05 17:21:12 dovecot_plain authenticator failed for (dercogel) [102.53.15.54]:54819: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-02-05 17:21:09 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:56565: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.56.203.129
description:
[2025-02-05 17:21:20 +0100] info [webmaild] 38.56.203.129 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-02-05 17:21:41 dovecot_plain authenticator failed for (neert) [212.164.211.155]:44222: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Feb  5 17:21:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.172.92.125
description:
[2025-02-05 17:21:30 +0100] info [webmaild] 177.172.92.125 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-02-05 17:22:06 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:28627: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Feb  5 17:21:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.221.201
description:
[2025-02-05 17:21:51 +0100] info [webmaild] 45.165.221.201 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-02-05 17:21:52 dovecot_login authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:56108: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Feb  5 17:22:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.167.42
description:
Feb  5 17:22:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.167.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.167.42
description:
2025-02-05 17:22:15 dovecot_login authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:63495: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-02-05 17:23:21 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:37075: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.245.102
description:
Feb  5 17:22:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.225.46
description:
2025-02-05 17:23:37 dovecot_plain authenticator failed for ([58.58.225.46]) [58.58.225.46]:45916: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.12
description:
2025-02-05 17:23:10 dovecot_login authenticator failed for (nsg-corporate-12.229.187.122.airtel.in) [122.187.229.12]:49694: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-02-05 17:23:34 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:56322: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.252.72.59
description:
[2025-02-05 17:23:32 +0100] info [webmaild] 37.252.72.59 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.225.46
description:
Feb  5 17:23:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.225.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Feb  5 17:23:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Feb  5 17:23:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Feb  5 17:23:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-02-05 17:23:21 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:38974: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-02-05 17:23:22 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:54918: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Feb  5 17:23:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.245.102
description:
2025-02-05 17:22:58 dovecot_login authenticator failed for p58102-obmd01.osaka.ocn.ne.jp [153.141.245.102]:43468: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.12
description:
Feb  5 17:23:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  5 17:24:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.184.110.220
description:
[2025-02-05 17:24:27 +0100] info [webmaild] 177.184.110.220 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.73.121.209
description:
Feb  5 17:24:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.73.121.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-05 17:24:29 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:54838: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
description:
2025-02-05 17:24:31 dovecot_login authenticator failed for (62-73-121-209.btc-net.bg) [62.73.121.209]:55545: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.38.235.47
description:
Feb  5 17:24:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.38.235.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Feb  5 17:24:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Feb  5 17:24:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
description:
2025-02-05 17:24:10 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:49986: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-02-05 17:23:55 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:55933: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.134.79
description:
[2025-02-05 17:23:55 +0100] info [webmaild] 131.196.134.79 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-02-05 17:24:03 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:40892: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-02-05 17:24:12 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:50814: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.38.235.47
description:
2025-02-05 17:24:13 dovecot_plain authenticator failed for adsl-178-38-235-47.adslplus.ch [178.38.235.47]:41536: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 17:24:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Feb  5 17:23:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.122.222.160
description:
[2025-02-05 17:24:05 +0100] info [webmaild] 190.122.222.160 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
description:
Feb  5 17:24:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
description:
Feb  5 17:24:42 ait sshd[688925]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
description:
Feb  5 17:24:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  5 17:24:42 ait sshd[688925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-02-05 17:24:45 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:1698: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 17:25:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.190.133.189
description:
[2025-02-05 17:26:38 +0100] info [webmaild] 103.190.133.189 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.54
description:
2025-02-05 17:26:18 dovecot_login authenticator failed for ([157.122.198.54]) [157.122.198.54]:56813: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.223.193.232
description:
Feb  5 17:26:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.223.193.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Feb  5 17:26:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-02-05 17:26:31 dovecot_login authenticator failed for ([60.167.19.30]) [60.167.19.30]:57129: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.40.194
description:
2025-02-05 17:26:17 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:57660: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.223.193.232
description:
2025-02-05 17:26:28 dovecot_login authenticator failed for (88-223-193-232.init.lt) [88.223.193.232]:50868: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.126.118.105
description:
[2025-02-05 17:26:37 +0100] info [webmaild] 92.126.118.105 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 17:25:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.234.85.233
description:
[2025-02-05 17:26:01 +0100] info [webmaild] 88.234.85.233 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.248.40.194
description:
Feb  5 17:26:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.248.40.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.54
description:
Feb  5 17:26:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-02-05 17:26:57 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:57687: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.38.242
description:
[2025-02-05 17:27:08 +0100] info [webmaild] 201.71.38.242 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.8.106
description:
Feb  5 17:27:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.8.106
description:
2025-02-05 17:27:19 dovecot_plain authenticator failed for ([58.16.8.106]) [58.16.8.106]:56535: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Feb  5 17:26:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
description:
2025-02-05 17:28:37 dovecot_login authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:38292: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
description:
Feb  5 17:28:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-05 17:28:21 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:40061: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
description:
2025-02-05 17:28:11 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:44470: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
description:
Feb  5 17:28:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  5 17:28:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
description:
2025-02-05 17:28:27 dovecot_login authenticator failed for ([125.72.92.174]) [125.72.92.174]:59209: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
description:
Feb  5 17:28:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.106.247
description:
[2025-02-05 17:28:32 +0100] info [webmaild] 45.4.106.247 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.87.67.247
description:
[2025-02-05 17:29:10 +0100] info [webmaild] 95.87.67.247 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.178.136
description:
[2025-02-05 17:29:13 +0100] info [webmaild] 168.197.178.136 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Feb  5 17:29:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.133.83.84
description:
[2025-02-05 17:29:49 +0100] info [webmaild] 31.133.83.84 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
description:
2025-02-05 17:30:00 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:54799: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-02-05 17:30:18 dovecot_plain authenticator failed for (parealli) [62.74.225.186]:54288: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Feb  5 17:30:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-02-05 17:29:48 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:34060: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
description:
Feb  5 17:29:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Feb  5 17:30:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-02-05 17:30:21 dovecot_plain authenticator failed for net-130-0-149-238.cust.vodafonedsl.it (unper) [130.0.149.238]:37870: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Feb  5 17:30:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-02-05 17:31:00 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:38584: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Feb  5 17:31:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
description:
Feb  5 17:31:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.166
description:
Feb  5 17:30:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Feb  5 17:30:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
description:
2025-02-05 17:30:58 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:37634: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.214.52.214
description:
2025-02-05 17:31:25 dovecot_plain authenticator failed for ([175.214.52.214]) [175.214.52.214]:57741: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.232.184
description:
2025-02-05 17:31:29 dovecot_plain authenticator failed for ([120.234.232.184]) [120.234.232.184]:52286: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  5 17:30:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.214.52.214
description:
Feb  5 17:31:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.214.52.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.144.210
description:
[2025-02-05 17:31:14 +0100] info [webmaild] 179.108.144.210 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-02-05 17:31:16 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:38442: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-05 17:30:53 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:47864: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.214.226
description:
2025-02-05 17:31:11 dovecot_plain authenticator failed for (broadband.actcorp.in) [115.245.214.226]:51198: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Feb  5 17:31:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.122
description:
Feb  5 17:31:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-02-05 17:31:30 dovecot_plain authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:55356: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-02-05 17:30:58 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:60294: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.214.226
description:
Feb  5 17:31:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.214.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.232.184
description:
Feb  5 17:31:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.232.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.122
description:
2025-02-05 17:31:17 dovecot_plain authenticator failed for ([61.185.226.122]) [61.185.226.122]:35720: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
description:
2025-02-05 17:31:18 dovecot_plain authenticator failed for ([175.136.192.106]) [175.136.192.106]:33360: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Feb  5 17:31:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-02-05 17:31:14 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:59353: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Feb  5 17:32:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.24.87.18
description:
Feb  5 17:32:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.24.87.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.233.188
description:
2025-02-05 17:32:13 dovecot_plain authenticator failed for ([178.216.233.188]) [178.216.233.188]:39984: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.59.211.214
description:
2025-02-05 17:32:31 dovecot_plain authenticator failed for ([201.59.211.214]) [201.59.211.214]:38229: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 17:31:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
description:
2025-02-05 17:32:13 dovecot_plain authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:39044: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-02-05 17:32:13 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:53836: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Feb  5 17:32:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.59.211.214
description:
Feb  5 17:32:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.59.211.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.221
description:
2025-02-05 17:32:06 dovecot_plain authenticator failed for ([113.64.208.221]) [113.64.208.221]:47485: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
description:
Feb  5 17:32:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-02-05 17:32:00 dovecot_plain authenticator failed for (static-TB-132-226.kbcnet.rs) [91.234.132.226]:34518: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-05 17:32:03 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:55881: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.233.188
description:
Feb  5 17:32:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.233.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.29.20.52
description:
Feb  5 17:32:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.29.20.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.183.220
description:
2025-02-05 17:32:19 dovecot_plain authenticator failed for ([157.122.183.220]) [157.122.183.220]:40067: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Feb  5 17:32:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Feb  5 17:32:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
description:
Feb  5 17:32:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-05 17:32:24 dovecot_plain authenticator failed for ([179.181.135.1]) [179.181.133.153]:55907: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
description:
2025-02-05 17:32:36 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:56205: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Feb  5 17:32:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.178.45
description:
Feb  5 17:32:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.178.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Feb  5 17:32:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Feb  5 17:31:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Feb  5 17:32:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
description:
Feb  5 17:32:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.20.228.20
description:
Feb  5 17:32:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.20.228.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Feb  5 17:32:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.212.0.13
description:
2025-02-05 17:32:20 dovecot_plain authenticator failed for ([60.212.0.13]) [60.212.0.13]:35841: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Feb  5 17:32:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.149
description:
2025-02-05 17:32:01 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.149]:50683: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-05 17:32:03 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:58957: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-02-05 17:32:18 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:58071: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
description:
2025-02-05 17:32:30 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:43114: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
description:
2025-02-05 17:32:05 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:35974: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
description:
Feb  5 17:32:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.56
description:
Feb  5 17:31:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
description:
Feb  5 17:32:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-02-05 17:32:02 dovecot_plain authenticator failed for (nsg-corporate-194.153.186.122.airtel.in) [106.51.220.33]:27866: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-05 17:32:17 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:56063: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.86.58.117
description:
Feb  5 17:32:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.86.58.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
description:
2025-02-05 17:32:03 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:45670: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.87.18
description:
2025-02-05 17:32:16 dovecot_plain authenticator failed for ([183.24.87.18]) [183.24.87.18]:35397: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Feb  5 17:32:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-02-05 17:32:20 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:46370: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Feb  5 17:32:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
description:
Feb  5 17:32:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.255.9.170
description:
Feb  5 17:32:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.255.9.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-02-05 17:32:23 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:60548: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
description:
2025-02-05 17:32:26 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:15942: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Feb  5 17:31:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
description:
2025-02-05 17:32:01 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:47714: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-02-05 17:32:03 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:35988: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.221
description:
Feb  5 17:32:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.214.102
description:
Feb  5 17:32:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.1.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
description:
Feb  5 17:32:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Feb  5 17:32:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-02-05 17:32:21 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:27267: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
description:
Feb  5 17:32:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
description:
2025-02-05 17:32:29 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:41394: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-02-05 17:32:02 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:1354: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
description:
2025-02-05 17:32:05 dovecot_plain authenticator failed for ([124.136.29.20]) [124.136.29.20]:26499: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.88.91.22
description:
Feb  5 17:32:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.88.91.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Feb  5 17:32:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Feb  5 17:32:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
description:
Feb  5 17:32:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.152.84
description:
[2025-02-05 17:32:23 +0100] info [webmaild] 45.181.152.84 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-02-05 17:32:37 dovecot_plain authenticator failed for ([1.180.230.98]) [1.180.230.98]:56466: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Feb  5 17:31:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
description:
Feb  5 17:31:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.148.95.217
description:
Feb  5 17:32:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.148.95.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-02-05 17:32:23 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:49857: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Feb  5 17:32:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
description:
2025-02-05 17:32:24 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:35641: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-02-05 17:32:26 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:42006: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
description:
Feb  5 17:32:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
description:
2025-02-05 17:32:14 dovecot_plain authenticator failed for ([41.216.84.18]) [41.216.84.18]:39359: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Feb  5 17:32:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
description:
2025-02-05 17:32:00 dovecot_plain authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:46656: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.210.49
description:
Feb  5 17:32:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.210.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-02-05 17:32:04 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:58878: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Feb  5 17:32:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.212.0.13
description:
Feb  5 17:32:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.212.0.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
description:
Feb  5 17:31:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-02-05 17:32:04 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:51148: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Feb  5 17:32:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.232.65
description:
Feb  5 17:32:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.232.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-02-05 17:32:38 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:49597: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
description:
2025-02-05 17:32:14 dovecot_plain authenticator failed for ([222.163.236.235]) [222.163.236.235]:45050: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-02-05 17:32:24 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:48607: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
description:
Feb  5 17:31:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
description:
2025-02-05 17:32:01 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:37788: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-02-05 17:32:04 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:40658: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  5 17:32:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
description:
Feb  5 17:32:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Feb  5 17:32:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.165.56
description:
[2025-02-05 17:31:52 +0100] info [webmaild] 168.195.165.56 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 17:32:15 ait sshd[692729]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
description:
2025-02-05 17:32:22 dovecot_login authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:55500: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.20
description:
2025-02-05 17:32:01 dovecot_plain authenticator failed for (201.218.181.20.viptel.com) [201.218.181.20]:46300: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Feb  5 17:32:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
description:
Feb  5 17:32:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
description:
2025-02-05 17:32:17 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:42247: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-02-05 17:31:58 dovecot_plain authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:41890: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
description:
2025-02-05 17:32:00 dovecot_plain authenticator failed for ([178.178.222.56]) [178.178.222.56]:34592: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.9.170
description:
2025-02-05 17:32:08 dovecot_plain authenticator failed for c83-255-9-170.bredband.tele2.se [83.255.9.170]:33868: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
description:
Feb  5 17:32:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
description:
2025-02-05 17:32:23 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:43820: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.149
description:
Feb  5 17:31:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-02-05 17:32:01 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:48823: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
description:
2025-02-05 17:32:02 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:42564: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.45
description:
2025-02-05 17:32:12 dovecot_plain authenticator failed for ([188.59.178.45]) [188.59.178.45]:40062: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Feb  5 17:31:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-02-05 17:32:18 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:60434: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-02-05 17:32:19 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:53693: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
description:
2025-02-05 17:32:25 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:41846: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
description:
Feb  5 17:32:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.226.45.227
description:
[2025-02-05 17:31:52 +0100] info [webmaild] 88.226.45.227 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Feb  5 17:31:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  5 17:32:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  5 17:32:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
description:
2025-02-05 17:32:26 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:37236: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-02-05 17:32:00 dovecot_plain authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:49854: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.210.49
description:
2025-02-05 17:32:07 dovecot_plain authenticator failed for (abts-kk-static-49.210.166.122.airtelbroadband.in) [122.166.210.49]:57616: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-02-05 17:32:12 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:42174: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.128.172
description:
2025-02-05 17:32:14 dovecot_plain authenticator failed for ([112.28.128.172]) [112.28.128.172]:48685: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.29.20.52
description:
2025-02-05 17:32:17 dovecot_plain authenticator failed for host-92-29-20-52.as13285.net [92.29.20.52]:44431: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.20
description:
Feb  5 17:31:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 17:32:15 ait sshd[692729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-02-05 17:32:21 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:54911: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
description:
2025-02-05 17:32:36 dovecot_login authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:51138: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Feb  5 17:32:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
description:
Feb  5 17:32:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Feb  5 17:32:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-02-05 17:32:11 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:39060: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
description:
2025-02-05 17:32:11 dovecot_plain authenticator failed for ([157.20.228.20]) [157.20.228.20]:45148: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
description:
2025-02-05 17:32:10 dovecot_plain authenticator failed for ([59.1.214.102]) [59.1.214.102]:42276: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
description:
Feb  5 17:32:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.88.91.22
description:
2025-02-05 17:32:16 dovecot_plain authenticator failed for syn-097-088-091-022.res.spectrum.com [97.88.91.22]:41888: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-02-05 17:32:26 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:32938: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Feb  5 17:32:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.128.172
description:
Feb  5 17:32:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.128.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
description:
Feb  5 17:32:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
description:
2025-02-05 17:32:20 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:53397: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  5 17:32:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.86.58.117
description:
2025-02-05 17:32:24 dovecot_plain authenticator failed for ([222.86.58.117]) [222.86.58.117]:48277: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-05 17:32:24 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:64362: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
description:
Feb  5 17:32:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-02-05 17:32:08 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:57264: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
description:
2025-02-05 17:32:09 dovecot_plain authenticator failed for ([38.148.95.217]) [38.148.95.217]:44333: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.127.195
description:
2025-02-05 17:32:13 dovecot_plain authenticator failed for ([39.164.127.195]) [39.164.127.195]:52202: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.183.220
description:
Feb  5 17:32:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.183.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-02-05 17:32:28 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:40548: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
description:
Feb  5 17:32:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-02-05 17:31:59 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:40818: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  5 17:32:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-02-05 17:32:08 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:56452: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.127.195
description:
Feb  5 17:32:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Feb  5 17:32:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
description:
Feb  5 17:32:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
description:
Feb  5 17:32:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-02-05 17:32:43 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:48929: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.20.6.2
description:
2025-02-05 17:32:48 dovecot_plain authenticator failed for (189-44-19-161.customer.tdatabrasil.net.br) [189.20.6.2]:54682: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 17:33:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-05 17:33:20 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:50468: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.193.70
description:
Feb  5 17:33:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.193.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
description:
2025-02-05 17:32:41 dovecot_plain authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:27739: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.193.70
description:
2025-02-05 17:33:32 dovecot_login authenticator failed for ([116.113.193.70]) [116.113.193.70]:18635: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.68.71
description:
2025-02-05 17:33:36 dovecot_plain authenticator failed for ([220.85.68.71]) [220.85.68.71]:56833: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.68.71
description:
Feb  5 17:33:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.68.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Feb  5 17:32:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
description:
2025-02-05 17:32:43 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:37186: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.20.6.2
description:
Feb  5 17:32:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.20.6.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  5 17:33:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  5 17:33:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-05 17:33:24 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:58137: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.89.54.10
description:
Feb  5 17:32:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.89.54.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.89.54.10
description:
2025-02-05 17:32:45 dovecot_plain authenticator failed for ip10.ip-51-89-54.eu [51.89.54.10]:50604: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.169.113
description:
Feb  5 17:33:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.169.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
description:
2025-02-05 17:33:13 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:45666: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 17:33:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.138
description:
Feb  5 17:34:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.138
description:
2025-02-05 17:34:30 dovecot_plain authenticator failed for ([121.202.155.138]) [121.202.155.138]:44861: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.114.93.57
description:
[2025-02-05 17:33:54 +0100] info [webmaild] 181.114.93.57 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Feb  5 17:34:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-02-05 17:34:05 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:17896: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.83.89
description:
Feb  5 17:34:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.83.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.98.10.109
description:
Feb  5 17:33:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.98.10.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
description:
2025-02-05 17:33:53 dovecot_plain authenticator failed for ([46.98.10.109]) [46.98.10.109]:56500: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Feb  5 17:34:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Feb  5 17:34:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-02-05 17:34:26 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:54931: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.89
description:
2025-02-05 17:34:27 dovecot_plain authenticator failed for ([119.207.83.89]) [119.207.83.89]:54103: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.147.228
description:
[2025-02-05 17:34:31 +0100] info [webmaild] 168.196.147.228 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-02-05 17:34:39 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:42266: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.235.62
description:
[2025-02-05 17:34:29 +0100] info [webmaild] 170.231.235.62 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
description:
Feb  5 17:34:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Feb  5 17:34:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
description:
2025-02-05 17:35:35 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:50520: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 17:35:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-35.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.71.58.25
description:
2025-02-05 17:34:43 dovecot_plain authenticator failed for ([45.71.58.25]) [45.71.58.25]:48958: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
description:
2025-02-05 17:34:44 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:39701: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Feb  5 17:34:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.162.203.231
description:
[2025-02-05 17:35:02 +0100] info [webmaild] 46.162.203.231 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.34.10
description:
2025-02-05 17:35:17 dovecot_plain authenticator failed for ([183.236.34.10]) [183.236.34.10]:50472: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.58.25
description:
Feb  5 17:34:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.58.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-02-05 17:34:56 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:33596: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.34.10
description:
Feb  5 17:35:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.34.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
description:
Feb  5 17:35:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-02-05 17:34:52 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:50289: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-02-05 17:35:59 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:41940: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.42.133.74
description:
Feb  5 17:36:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.42.133.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.42.133.74
description:
2025-02-05 17:36:14 dovecot_plain authenticator failed for ([61.42.133.74]) [61.42.133.74]:57336: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
description:
Feb  5 17:35:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Feb  5 17:35:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
description:
2025-02-05 17:35:50 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:43996: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-02-05 17:35:52 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:35948: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Feb  5 17:35:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Feb  5 17:36:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-02-05 17:36:07 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:17116: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.181.154.216
description:
[2025-02-05 17:36:24 +0100] info [webmaild] 78.181.154.216 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.1.137.189
description:
[2025-02-05 17:37:01 +0100] info [webmaild] 201.1.137.189 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.41
description:
[2025-02-05 17:37:02 +0100] info [webmaild] 84.54.72.41 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.228.8
description:
[2025-02-05 17:37:35 +0100] info [webmaild] 37.40.228.8 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 17:38:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Feb  5 17:38:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
description:
Feb  5 17:38:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.154.91.19
description:
[2025-02-05 17:39:28 +0100] info [webmaild] 177.154.91.19 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.246.91.138
description:
[2025-02-05 17:39:33 +0100] info [webmaild] 194.246.91.138 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
description:
2025-02-05 17:39:17 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:52812: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-02-05 17:38:41 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:11883: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Feb  5 17:38:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.23
description:
2025-02-05 17:39:06 dovecot_plain authenticator failed for ([42.180.162.23]) [42.180.162.23]:47897: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
description:
Feb  5 17:39:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.241.41.172
description:
[2025-02-05 17:38:50 +0100] info [webmaild] 88.241.41.172 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.23
description:
Feb  5 17:39:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-02-05 17:38:56 dovecot_login authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:49782: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.71.17.99
description:
[2025-02-05 17:40:06 +0100] info [webmaild] 105.71.17.99 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.158.182
description:
2025-02-05 17:40:18 dovecot_login authenticator failed for (182.158.57.37.triolan.net) [37.57.158.182]:55733: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.38.121
description:
Feb  5 17:40:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.38.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  5 17:40:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.224.38.121
description:
2025-02-05 17:40:09 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.38.121]:25010: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-05 17:40:10 dovecot_plain authenticator failed for (povas) [46.30.161.197]:58777: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.158.182
description:
Feb  5 17:40:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.158.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 17:39:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
description:
2025-02-05 17:41:38 dovecot_plain authenticator failed for ([220.77.182.169]) [220.77.182.169]:36149: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
description:
Feb  5 17:41:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
description:
Feb  5 17:41:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.241.252
description:
Feb  5 17:41:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.241.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.114.5
description:
[2025-02-05 17:41:38 +0100] info [webmaild] 37.239.114.5 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.241.252
description:
2025-02-05 17:41:39 dovecot_plain authenticator failed for ([183.220.241.252]) [183.220.241.252]:60810: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-02-05 17:40:55 dovecot_plain authenticator failed for (coebilbure) [64.72.74.162]:48789: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
description:
Feb  5 17:41:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.67.5.146
description:
Feb  5 17:41:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.67.5.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
description:
Feb  5 17:41:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 17:41:02 ait sshd[697196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-05 17:41:37 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:44215: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.67.5.146
description:
2025-02-05 17:41:38 dovecot_plain authenticator failed for ([183.67.5.146]) [183.67.5.146]:56070: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-02-05 17:41:35 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:45533: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.248.178.230
description:
Feb  5 17:41:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.248.178.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  5 17:41:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.109.138
description:
Feb  5 17:41:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.109.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-05 17:41:37 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:58720: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.30
description:
2025-02-05 17:41:39 dovecot_plain authenticator failed for ([110.35.63.30]) [110.35.63.30]:38328: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
description:
2025-02-05 17:41:39 dovecot_plain authenticator failed for ([39.165.154.222]) [39.165.154.222]:55504: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  5 17:41:02 ait sshd[697196]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
description:
2025-02-05 17:41:36 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:34096: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.30
description:
Feb  5 17:41:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
description:
2025-02-05 17:41:38 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:36948: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  5 17:41:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
description:
Feb  5 17:41:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  5 17:41:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.109.138
description:
2025-02-05 17:41:38 dovecot_plain authenticator failed for ([222.190.109.138]) [222.190.109.138]:33243: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
description:
Feb  5 17:41:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Feb  5 17:40:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Feb  5 17:42:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
description:
Feb  5 17:41:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Feb  5 17:41:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-02-05 17:41:48 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:49264: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Feb  5 17:41:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
description:
Feb  5 17:41:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.254.114
description:
Feb  5 17:41:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.254.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
description:
Feb  5 17:42:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-02-05 17:42:13 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:38106: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.216.102.251
description:
[2025-02-05 17:42:36 +0100] info [webmaild] 201.216.102.251 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
description:
Feb  5 17:41:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-05 17:41:53 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:52868: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.89.60.158
description:
Feb  5 17:41:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.89.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
description:
2025-02-05 17:41:55 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:53485: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
description:
2025-02-05 17:42:00 dovecot_plain authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:39121: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-05 17:41:42 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:57450: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.170.200
description:
2025-02-05 17:41:49 dovecot_plain authenticator failed for (broadband-37.204-170-200.ip.moscow.rt.ru) [37.204.170.200]:53239: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-02-05 17:42:28 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:22842: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.109.253.182
description:
Feb  5 17:42:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.109.253.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.248.178.230
description:
2025-02-05 17:41:42 dovecot_plain authenticator failed for 60-248-178-230.hinet-ip.hinet.net [60.248.178.230]:49213: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Feb  5 17:41:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Feb  5 17:41:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  5 17:41:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
description:
Feb  5 17:41:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.42.133.74
description:
Feb  5 17:41:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.42.133.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
description:
2025-02-05 17:41:53 dovecot_plain authenticator failed for ([65.20.204.34]) [65.20.204.34]:47075: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.109.253.182
description:
2025-02-05 17:42:02 dovecot_plain authenticator failed for ([172.109.253.182]) [172.109.253.182]:41744: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.22.18.31
description:
[2025-02-05 17:42:04 +0100] info [webmaild] 186.22.18.31 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
description:
2025-02-05 17:42:13 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:41674: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Feb  5 17:42:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-02-05 17:41:52 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:11597: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.44.165
description:
Feb  5 17:41:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.44.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-02-05 17:41:55 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:58533: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
description:
2025-02-05 17:41:56 dovecot_plain authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:37110: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.121.69
description:
2025-02-05 17:42:39 dovecot_plain authenticator failed for ([183.238.121.69]) [183.238.121.69]:40829: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
description:
2025-02-05 17:41:43 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:45989: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.111
description:
Feb  5 17:41:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-02-05 17:41:51 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:42977: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Feb  5 17:41:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.42.21
description:
[2025-02-05 17:42:14 +0100] info [webmaild] 91.106.42.21 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-02-05 17:41:46 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (girohi) [195.159.217.71]:51288: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.111
description:
2025-02-05 17:41:48 dovecot_plain authenticator failed for ([65.20.213.111]) [65.20.213.111]:33535: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.42.133.74
description:
2025-02-05 17:41:56 dovecot_plain authenticator failed for ([61.42.133.74]) [61.42.133.74]:37393: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-02-05 17:41:41 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:59093: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.170.200
description:
Feb  5 17:41:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.170.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.44.165
description:
2025-02-05 17:41:55 dovecot_plain authenticator failed for ([49.245.44.165]) [49.245.44.165]:59913: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.89.60.158
description:
2025-02-05 17:41:56 dovecot_plain authenticator failed for ([124.89.60.158]) [124.89.60.158]:46108: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.121.69
description:
Feb  5 17:42:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.121.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  5 17:43:03 ait sshd[697990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  5 17:43:03 ait sshd[697990]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.54.53.28
description:
[2025-02-05 17:44:09 +0100] info [webmaild] 94.54.53.28 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.159.237.86
description:
[2025-02-05 17:44:37 +0100] info [webmaild] 154.159.237.86 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Feb  5 17:45:30 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Feb  5 17:45:33 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.155.17.202
description:
[2025-02-05 17:44:44 +0100] info [webmaild] 105.155.17.202 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.241.71.114
description:
[2025-02-05 17:45:09 +0100] info [webmaild] 191.241.71.114 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-02-05 17:45:32 dovecot_plain authenticator failed for (dighthed) [91.116.42.218]:34562: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-02-05 17:45:35 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (anics) [195.159.217.71]:41628: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.248.116.230
description:
Feb  5 17:46:23 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.248.116.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.248.116.230
description:
2025-02-05 17:46:25 dovecot_plain authenticator failed for data.autofrant.ru (untachs) [151.248.116.230]:35026: 535 Incorrect authentication data (set_id=eng20a00070y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.110.214.71
description:
[2025-02-05 17:47:21 +0100] info [webmaild] 37.110.214.71 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  5 17:47:22 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-05 17:47:24 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (feguentest) [176.37.212.85]:37714: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 17:47:26 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.98.249.9
description:
Feb  5 17:47:09 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.98.249.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.98.249.9
description:
2025-02-05 17:47:11 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:52520: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Feb  5 17:47:21 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.75.251.74
description:
[2025-02-05 17:47:40 +0100] info [webmaild] 178.75.251.74 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.74.68
description:
[2025-02-05 17:46:47 +0100] info [webmaild] 177.125.74.68 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.126.175.203
description:
[2025-02-05 17:47:10 +0100] info [webmaild] 109.126.175.203 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 17:47:23 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:42819: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  5 17:48:22 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-05 17:48:24 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:51286: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-02-05 17:48:10 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:46882: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Feb  5 17:48:08 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Feb  5 17:49:23 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.96.151.110
description:
Feb  5 17:49:35 ait sshd[700854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.96.151.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Feb  5 17:49:35 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Feb  5 17:49:35 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
description:
Feb  5 17:49:19 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-02-05 17:49:21 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:55449: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-02-05 17:49:25 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:54176: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.96.151.110
description:
Feb  5 17:49:35 ait sshd[700854]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.96.151.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.18.229
description:
[2025-02-05 17:49:37 +0100] info [webmaild] 170.80.18.229 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.146.210
description:
2025-02-05 17:49:37 dovecot_login authenticator failed for ([122.227.146.210]) [122.227.146.210]:54445: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-02-05 17:49:37 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:50900: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.49.88.159
description:
[2025-02-05 17:50:13 +0100] info [webmaild] 187.49.88.159 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-50.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.99.33.157
description:
[2025-02-05 17:50:18 +0100] info [webmaild] 185.99.33.157 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.232.177.171
description:
[2025-02-05 17:49:48 +0100] info [webmaild] 94.232.177.171 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Feb  5 17:52:12 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-02-05 17:52:14 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:48924: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.52.206
description:
[2025-02-05 17:52:22 +0100] info [webmaild] 170.79.52.206 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.222.60.226
description:
[2025-02-05 17:52:24 +0100] info [webmaild] 176.222.60.226 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.65.21
description:
Feb  5 17:52:41 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.65.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.65.21
description:
2025-02-05 17:52:43 dovecot_plain authenticator failed for ([183.220.65.21]) [183.220.65.21]:54322: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
description:
Feb  5 17:53:35 ait sshd[702911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.248.207.71
description:
[2025-02-05 17:52:56 +0100] info [webmaild] 103.248.207.71 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.43.94.102
description:
[2025-02-05 17:53:01 +0100] info [webmaild] 103.43.94.102 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
description:
Feb  5 17:53:35 ait sshd[702911]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.36
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:couragekojoetse@gmail.com||WPU:couragekojoetse@gmail.com||RSV:6.65||T:APACHE||MV:17-54.204.10.194.36


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Feb  5 17:54:37 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-02-05 17:54:39 dovecot_login authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:60214: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.15.40.171
description:
[2025-02-05 17:55:02 +0100] info [webmaild] 189.15.40.171 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Feb  5 17:55:07 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-02-05 17:55:09 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:50728: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
description:
Feb  5 17:55:20 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.204.211.13
description:
[2025-02-05 17:55:36 +0100] info [webmaild] 177.204.211.13 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.130.156.0
description:
[2025-02-05 17:54:58 +0100] info [webmaild] 188.130.156.0 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Feb  5 17:54:46 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
description:
2025-02-05 17:55:22 dovecot_plain authenticator failed for ([183.6.43.236]) [183.6.43.236]:47249: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.27.228.17
description:
[2025-02-05 17:55:25 +0100] info [webmaild] 186.27.228.17 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-02-05 17:54:48 dovecot_login authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:34498: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  5 17:56:14 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-05 17:56:20 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:60477: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
description:
2025-02-05 17:56:24 dovecot_login authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:64218: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
description:
2025-02-05 17:56:28 dovecot_plain authenticator failed for (189-113-43-174.netturbo.com.br) [189.113.43.174]:37588: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Feb  5 17:56:16 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  5 17:56:18 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
description:
2025-02-05 17:56:35 dovecot_login authenticator failed for (210-84-5-183.tpgi.com.au) [210.84.5.183]:37469: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.113.43.174
description:
Feb  5 17:56:26 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.113.43.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.85.107.135
description:
Feb  5 17:56:34 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.85.107.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 17:56:11 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-05 17:56:16 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:60466: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-05 17:56:18 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:58134: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.174.103.74
description:
Feb  5 17:56:22 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.174.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  5 17:56:25 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-05 17:56:27 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:39524: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
description:
Feb  5 17:56:33 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.107.135
description:
2025-02-05 17:56:36 dovecot_plain authenticator failed for ([222.85.107.135]) [222.85.107.135]:37429: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-02-05 17:57:01 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:58222: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
description:
2025-02-05 17:57:09 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:51166: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Feb  5 17:57:27 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.17
description:
Feb  5 17:57:28 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.116.252.235
description:
[2025-02-05 17:57:32 +0100] info [webmaild] 46.116.252.235 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  5 17:57:34 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
description:
2025-02-05 17:57:34 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:44756: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-02-05 17:57:29 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:57778: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.76.81.161
description:
[2025-02-05 17:57:37 +0100] info [webmaild] 105.76.81.161 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Feb  5 17:57:40 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
description:
Feb  5 17:56:59 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
description:
Feb  5 17:57:07 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Feb  5 17:57:17 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-02-05 17:57:19 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:2766: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.237.143
description:
Feb  5 17:57:32 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.237.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Feb  5 17:57:40 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.17
description:
2025-02-05 17:57:30 dovecot_plain authenticator failed for ([121.154.90.17]) [121.154.90.17]:39928: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-05 17:57:36 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:40156: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.130.175.68
description:
[2025-02-05 17:58:02 +0100] info [webmaild] 85.130.175.68 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.210.170
description:
2025-02-05 17:58:02 dovecot_plain authenticator failed for ([113.64.210.170]) [113.64.210.170]:40823: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.85.203.64
description:
[2025-02-05 17:58:11 +0100] info [webmaild] 187.85.203.64 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.55.59
description:
Feb  5 17:58:18 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.55.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.55.59
description:
2025-02-05 17:58:20 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:49350: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-02-05 17:57:42 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:46582: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-02-05 17:57:42 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:57940: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.210.170
description:
Feb  5 17:58:00 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.210.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Feb  5 17:59:02 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-02-05 17:59:04 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:59335: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.252
description:
Feb  5 18:00:22 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.12.84
description:
2025-02-05 18:00:33 dovecot_login authenticator failed for 111-70-12-84.emome-ip.hinet.net [111.70.12.84]:35183: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Feb  5 18:00:38 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.52.83.174
description:
[2025-02-05 18:00:17 +0100] info [webmaild] 177.52.83.174 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.29.76.99
description:
2025-02-05 18:00:13 dovecot_login authenticator failed for ([14.29.76.100]) [14.29.76.99]:51695: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.252
description:
2025-02-05 18:00:24 dovecot_plain authenticator failed for ([211.247.127.252]) [211.247.127.252]:37656: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Feb  5 18:00:34 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.29.76.99
description:
Feb  5 18:00:11 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.29.76.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-05 18:00:17 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:19589: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.126
description:
Feb  5 18:00:30 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.12.84
description:
Feb  5 18:00:31 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.12.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.126
description:
2025-02-05 18:00:32 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:57468: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.224.77
description:
[2025-02-05 18:00:36 +0100] info [webmaild] 187.19.224.77 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
description:
2025-02-05 18:00:05 dovecot_plain authenticator failed for ([191.59.192.17]) [191.59.192.17]:51772: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-02-05 18:00:36 dovecot_plain authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:57182: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-02-05 18:00:40 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:34730: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.29.29.167
description:
[2025-02-05 18:00:05 +0100] info [webmaild] 217.29.29.167 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  5 18:00:15 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.233.237.161
description:
[2025-02-05 18:00:50 +0100] info [webmaild] 94.233.237.161 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Feb  5 18:00:52 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-02-05 18:00:54 dovecot_login authenticator failed for (m121-202-152-7.smartone.com) [121.202.152.7]:18006: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Feb  5 18:02:07 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-02-05 18:02:09 dovecot_plain authenticator failed for ([60.31.249.131]) [60.31.249.131]:47501: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Feb  5 18:02:19 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-02-05 18:02:21 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:52546: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 18:03:21 dovecot_plain authenticator failed for ([216.194.174.27]) [216.194.174.27]:30329: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.17.125.28
description:
2025-02-05 18:03:22 dovecot_plain authenticator failed for ([120.55.170.138]) [183.17.125.28]:6403: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.221.114
description:
[2025-02-05 18:03:35 +0100] info [webmaild] 45.165.221.114 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.43.200.34
description:
[2025-02-05 18:02:53 +0100] info [webmaild] 197.43.200.34 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.95.42.93
description:
[2025-02-05 18:03:04 +0100] info [webmaild] 201.95.42.93 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Feb  5 18:03:19 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.17.125.28
description:
Feb  5 18:03:20 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.17.125.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.155
description:
Feb  5 18:03:36 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.155
description:
2025-02-05 18:03:38 dovecot_plain authenticator failed for ([27.40.100.155]) [27.40.100.155]:39856: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-02-05 18:03:03 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:38699: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.249.128
description:
[2025-02-05 18:03:25 +0100] info [webmaild] 177.125.249.128 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Feb  5 18:03:01 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.202.59.203
description:
2025-02-05 18:04:22 dovecot_plain authenticator failed for (dyn-cable-cust.203.59.202.213.quicknet.ch) [213.202.59.203]:51586: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Feb  5 18:04:09 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-02-05 18:04:11 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:34400: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.202.59.203
description:
Feb  5 18:04:20 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.202.59.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.170.35.50
description:
Feb  5 18:05:34 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.170.35.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.170.35.50
description:
2025-02-05 18:05:36 dovecot_plain authenticator failed for 50.35.170.34.bc.googleusercontent.com [34.170.35.50]:43338: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-05.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
description:
Feb  5 18:05:15 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
description:
2025-02-05 18:05:17 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:33389: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.167.126
description:
[2025-02-05 18:05:42 +0100] info [webmaild] 90.156.167.126 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.85.44.68
description:
[2025-02-05 18:05:47 +0100] info [webmaild] 187.85.44.68 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.238.151
description:
[2025-02-05 18:06:16 +0100] info [webmaild] 138.118.238.151 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.120.28.143
description:
[2025-02-05 18:06:17 +0100] info [webmaild] 187.120.28.143 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.222.174.50
description:
2025-02-05 18:06:48 dovecot_login authenticator failed for ([102.222.174.50]) [102.222.174.50]:53934: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.31
description:
2025-02-05 18:07:13 dovecot_login authenticator failed for ([104.241.229.31]) [104.241.229.31]:33914: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
description:
2025-02-05 18:07:40 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:58100: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.222.174.50
description:
Feb  5 18:06:46 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.222.174.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.31
description:
Feb  5 18:07:11 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
description:
Feb  5 18:07:38 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Feb  5 18:07:39 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
description:
2025-02-05 18:07:54 dovecot_plain authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:35660: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-02-05 18:08:14 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:45929: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
description:
Feb  5 18:08:24 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.4.159
description:
[2025-02-05 18:08:26 +0100] info [webmaild] 169.224.4.159 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Feb  5 18:07:55 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
description:
2025-02-05 18:08:26 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:49111: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.4.36
description:
[2025-02-05 18:08:28 +0100] info [webmaild] 177.87.4.36 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-02-05 18:07:41 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:34474: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.144
description:
Feb  5 18:07:52 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-02-05 18:07:57 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:44296: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Feb  5 18:08:12 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
description:
Feb  5 18:09:35 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-02-05 18:09:37 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:53450: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.24.5.247
description:
[2025-02-05 18:08:59 +0100] info [webmaild] 181.24.5.247 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 59.153.17.133
description:
[2025-02-05 18:09:02 +0100] info [webmaild] 59.153.17.133 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.141.106
description:
2025-02-05 18:09:47 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:36239: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.236.141.106
description:
Feb  5 18:09:45 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.236.141.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.36.161.116
description:
[2025-02-05 18:11:31 +0100] info [webmaild] 5.36.161.116 - no-reply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.195.130
description:
[2025-02-05 18:10:57 +0100] info [webmaild] 168.196.195.130 - no-reply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.33.139.238
description:
[2025-02-05 18:11:01 +0100] info [webmaild] 177.33.139.238 - no-reply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.163.46
description:
[2025-02-05 18:11:32 +0100] info [webmaild] 138.97.163.46 - no-reply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-02-05 18:11:59 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:52445: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 18:12:09 dovecot_plain authenticator failed for ([27.223.100.90]) [27.223.100.90]:33258: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
description:
Feb  5 18:12:11 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
description:
2025-02-05 18:12:13 dovecot_plain authenticator failed for ([183.237.33.162]) [183.237.33.162]:64060: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.172.24
description:
2025-02-05 18:12:03 dovecot_plain authenticator failed for (uncealls) [65.20.172.24]:41382: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.200.71
description:
2025-02-05 18:12:07 dovecot_plain authenticator failed for (yering) [65.20.200.71]:44210: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
description:
Feb  5 18:12:20 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Feb  5 18:12:27 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 18:12:32 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.200.71
description:
Feb  5 18:12:05 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.200.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.179.112
description:
2025-02-05 18:12:17 dovecot_plain authenticator failed for ([218.149.179.112]) [218.149.179.112]:45088: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.6.38
description:
Feb  5 18:12:24 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
description:
2025-02-05 18:12:35 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:47526: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-02-05 18:12:00 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:39238: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.172.24
description:
Feb  5 18:12:01 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.172.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
description:
Feb  5 18:12:12 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.179.112
description:
Feb  5 18:12:15 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.179.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Feb  5 18:11:58 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Feb  5 18:12:17 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.6.38
description:
2025-02-05 18:12:26 dovecot_plain authenticator failed for 111-70-6-38.emome-ip.hinet.net [111.70.6.38]:33844: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.103.215
description:
Feb  5 18:11:56 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.122.103.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
description:
Feb  5 18:12:11 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-05 18:12:29 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:55088: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Feb  5 18:11:57 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-02-05 18:12:00 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:44488: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.97.138
description:
Feb  5 18:12:14 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
description:
2025-02-05 18:12:13 dovecot_plain authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:58142: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
description:
2025-02-05 18:12:16 dovecot_plain authenticator failed for ([1.180.97.138]) [1.180.97.138]:58345: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-02-05 18:12:19 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:62128: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
description:
2025-02-05 18:12:22 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:54872: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 18:12:34 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:43213: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Feb  5 18:11:58 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.103.215
description:
2025-02-05 18:11:58 dovecot_plain authenticator failed for ([222.122.103.215]) [222.122.103.215]:34203: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 18:12:07 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
description:
2025-02-05 18:12:14 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:58454: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.231.102.189
description:
Feb  5 18:12:33 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.231.102.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-02-05 18:13:07 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:46738: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Feb  5 18:12:52 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
description:
2025-02-05 18:12:55 dovecot_plain authenticator failed for ([121.202.138.181]) [121.202.138.181]:53132: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Feb  5 18:13:07 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-05 18:13:16 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:61235: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.28.51
description:
Feb  5 18:13:20 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.28.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.102
description:
Feb  5 18:12:52 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
description:
Feb  5 18:12:53 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-02-05 18:13:00 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:60044: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
description:
2025-02-05 18:13:08 dovecot_plain authenticator failed for (113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:47209: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
description:
Feb  5 18:12:54 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  5 18:13:14 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.18.252.107
description:
Feb  5 18:13:16 ait auth[699299]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.18.252.107 has been locked due to Imunify RBL


