# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
description:
2025-02-04 19:13:30 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:52105: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.129.199
description:
2025-02-04 19:13:13 dovecot_plain authenticator failed for ([203.172.129.199]) [203.172.129.199]:59562: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-02-04 19:13:16 dovecot_plain authenticator failed for ([116.113.254.26]) [116.113.254.26]:34054: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.46.114
description:
2025-02-04 19:13:19 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:60926: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
description:
2025-02-04 19:13:26 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:36414: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  4 19:13:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
description:
Feb  4 19:13:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
description:
2025-02-04 19:13:13 dovecot_plain authenticator failed for ([177.2.161.89]) [177.2.161.66]:35517: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.140.89.82
description:
Feb  4 19:13:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.140.89.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-04 19:13:29 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:56288: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  4 19:13:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.20.46.114
description:
Feb  4 19:13:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.20.46.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Feb  4 19:13:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Feb  4 19:13:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-02-04 19:13:19 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:37011: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.112.194.160
description:
Feb  4 19:13:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.112.194.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-02-04 19:13:11 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2223: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-02-04 19:13:24 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:34905: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-02-04 19:13:31 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:38180: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
description:
Feb  4 19:13:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-02-04 19:13:18 dovecot_plain authenticator failed for (78-134-19-99.static.eolo.it) [78.134.19.99]:58588: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.89
description:
Feb  4 19:13:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-02-04 19:13:26 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:8078: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Feb  4 19:13:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
description:
2025-02-04 19:13:31 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:51054: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
description:
Feb  4 19:13:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
description:
2025-02-04 19:13:17 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:54528: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.138.56.193
description:
Feb  4 19:13:25 ait sshd[103160]: pam_imunify(sshd:auth): [IM360_RBL] The IP 78.138.56.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-02-04 19:13:26 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:14810: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-02-04 19:13:39 dovecot_plain authenticator failed for ([38.49.182.103]) [38.49.182.103]:47452: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.129.199
description:
Feb  4 19:13:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.129.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-04 19:13:13 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:27800: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
description:
2025-02-04 19:13:22 dovecot_plain authenticator failed for ([92.118.235.228]) [92.118.235.228]:58068: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.138.56.193
description:
Feb  4 19:13:25 ait sshd[103160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.138.56.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
description:
Feb  4 19:13:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.220.112
description:
2025-02-04 19:13:28 dovecot_plain authenticator failed for (abts-north-static-112.220.23.125.airtelbroadband.in) [125.23.220.112]:57896: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.10.53.104
description:
Feb  4 19:13:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.10.53.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
description:
Feb  4 19:13:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Feb  4 19:13:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
description:
Feb  4 19:13:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Feb  4 19:13:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.129
description:
2025-02-04 19:13:42 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:50060: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-14.118.67.214.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
description:
2025-02-04 19:13:12 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:52244: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
description:
2025-02-04 19:13:14 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:32824: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
description:
2025-02-04 19:13:16 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:32824: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
description:
2025-02-04 19:13:18 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:55288: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-02-04 19:13:24 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:37350: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Feb  4 19:13:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.84.34.85
description:
Feb  4 19:13:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.84.34.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.237.146
description:
Feb  4 19:13:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.237.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Feb  4 19:13:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.135
description:
2025-02-04 19:13:18 dovecot_plain authenticator failed for (223-197-153-135.static.imsbiz.com) [223.197.153.135]:53738: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.208.245
description:
2025-02-04 19:13:22 dovecot_plain authenticator failed for (m121-202-208-245.smartone.com) [121.202.208.245]:46777: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.237.146
description:
2025-02-04 19:13:13 dovecot_plain authenticator failed for ([120.196.237.146]) [120.196.237.146]:38941: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-02-04 19:13:20 dovecot_plain authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.229]:42321: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Feb  4 19:13:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Feb  4 19:13:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.89
description:
2025-02-04 19:13:26 dovecot_plain authenticator failed for (5x166x68x89.dynamic.barnaul.ertelecom.ru) [5.166.68.89]:42770: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.129
description:
Feb  4 19:13:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.112.194.160
description:
2025-02-04 19:13:34 dovecot_plain authenticator failed for ([106.112.194.160]) [106.112.194.160]:45165: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.10.53.104
description:
2025-02-04 19:13:12 dovecot_plain authenticator failed for host-79-10-53-104.business.telecomitalia.it [79.10.53.104]:57984: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
description:
2025-02-04 19:13:14 dovecot_plain authenticator failed for (187-50-150-169.customer.tdatabrasil.net.br) [187.50.67.114]:41470: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-02-04 19:13:18 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:58732: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
description:
2025-02-04 19:13:18 dovecot_plain authenticator failed for ([203.192.247.84]) [203.192.247.84]:45946: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Feb  4 19:13:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-02-04 19:13:33 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:57008: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
description:
Feb  4 19:15:09 ait sshd[104019]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
description:
Feb  4 19:14:22 ait sshd[103570]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Feb  4 19:14:36 ait sshd[103612]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Feb  4 19:14:36 ait sshd[103612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
description:
Feb  4 19:15:09 ait sshd[104019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
description:
Feb  4 19:14:22 ait sshd[103570]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.82.98.23
description:
[2025-02-04 19:15:05 +0100] info [webmaild] 186.82.98.23 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
description:
Feb  4 19:15:58 ait sshd[104456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
description:
Feb  4 19:15:58 ait sshd[104456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.244.41
description:
Feb  4 19:15:11 ait sshd[104019]: Failed password for invalid user jodi from 216.10.244.41 port 46914 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.41.0.73
description:
[2025-02-04 19:15:35 +0100] info [webmaild] 37.41.0.73 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.135.172.223
description:
[2025-02-04 19:15:21 +0100] info [webmaild] 102.135.172.223 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.186.46
description:
[2025-02-04 19:16:01 +0100] info [webmaild] 138.97.186.46 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
description:
Feb  4 19:16:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  4 19:16:49 ait sshd[104629]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
description:
2025-02-04 19:16:51 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:58900: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.247
description:
Feb  4 19:16:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.252.115
description:
2025-02-04 19:16:29 dovecot_plain authenticator failed for (189-20-254-233.customer.tdatabrasil.net.br) [189.56.252.115]:57468: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-02-04 19:16:37 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:39830: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  4 19:16:49 ait sshd[104629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
description:
2025-02-04 19:16:53 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:49547: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
description:
2025-02-04 19:16:14 dovecot_plain authenticator failed for bzq-85-130-207-117.static.bezeqint.net [85.130.207.117]:50694: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
description:
Feb  4 19:16:22 ait sshd[104519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
description:
Feb  4 19:16:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
description:
2025-02-04 19:16:51 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:38657: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.75.69
description:
2025-02-04 19:16:19 dovecot_plain authenticator failed for ([49.231.75.69]) [49.231.75.69]:40114: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
description:
Feb  4 19:16:22 ait sshd[104519]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
description:
Feb  4 19:16:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
description:
Feb  4 19:16:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
description:
Feb  4 19:17:03 ait sshd[104809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
description:
Feb  4 19:16:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
description:
Feb  4 19:16:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
description:
Feb  4 19:16:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.186.253
description:
2025-02-04 19:16:37 dovecot_plain authenticator failed for ([222.67.186.253]) [222.67.186.253]:55060: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
description:
2025-02-04 19:16:38 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:45914: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Feb  4 19:16:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.231.75.69
description:
Feb  4 19:16:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.231.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-02-04 19:16:34 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:52122: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.186.253
description:
Feb  4 19:16:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.186.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-02-04 19:16:48 dovecot_login authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:55461: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
description:
2025-02-04 19:17:00 dovecot_login authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:48553: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
description:
Feb  4 19:17:03 ait sshd[104809]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.252.115
description:
Feb  4 19:16:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.252.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
description:
Feb  4 19:17:59 ait sshd[105277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
description:
Feb  4 19:17:59 ait sshd[105277]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.133.212
description:
[2025-02-04 19:18:01 +0100] info [webmaild] 170.245.133.212 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.54.89.216
description:
[2025-02-04 19:18:06 +0100] info [webmaild] 186.54.89.216 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
description:
2025-02-04 19:17:54 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:51476: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.236.214
description:
Feb  4 19:17:23 ait sshd[104891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.236.214


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.253.30.71
description:
[2025-02-04 19:17:35 +0100] info [webmaild] 92.253.30.71 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-02-04 19:17:45 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:59030: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
description:
Feb  4 19:17:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.236.214
description:
Feb  4 19:17:23 ait sshd[104891]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.236.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
description:
Feb  4 19:17:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.240.129.68
description:
Feb  4 19:17:17 ait sshd[104877]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.240.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.240.129.68
description:
Feb  4 19:17:17 ait sshd[104877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.240.129.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Feb  4 19:18:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-02-04 19:18:26 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:43542: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Feb  4 19:18:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-04 19:18:31 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:54821: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Feb  4 19:18:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.116
description:
Feb  4 19:19:09 ait dovecot[3957549]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.116, lip=136.243.145.84, TLS, session=<KaGGC1UtI9S594l0>


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.160
description:
Feb  4 19:18:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.6.72.90
description:
[2025-02-04 19:18:28 +0100] info [webmaild] 213.6.72.90 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Feb  4 19:18:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
description:
2025-02-04 19:19:02 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:41562: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.42.21.221
description:
[2025-02-04 19:18:30 +0100] info [webmaild] 186.42.21.221 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.241.234
description:
Feb  4 19:18:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.241.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-02-04 19:18:45 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:17891: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-02-04 19:18:55 dovecot_plain authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:62315: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.160
description:
2025-02-04 19:18:28 dovecot_plain authenticator failed for ([218.149.228.160]) [218.149.228.160]:49570: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
description:
2025-02-04 19:18:41 dovecot_plain authenticator failed for ([210.22.130.22]) [58.246.241.234]:38431: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
description:
Feb  4 19:19:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-02-04 19:19:33 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:25595: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  4 19:19:41 ait sshd[105732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 19:19:55 ait sshd[105776]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 19:19:55 ait sshd[105776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
description:
Feb  4 19:19:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
description:
2025-02-04 19:19:16 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:37862: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
description:
Feb  4 19:19:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  4 19:19:21 ait sshd[105675]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Feb  4 19:19:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  4 19:19:41 ait sshd[105732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-02-04 19:19:18 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:45642: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  4 19:19:21 ait sshd[105675]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  4 19:20:57 ait sshd[106563]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  4 19:20:57 ait sshd[106563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.227.160.200
description:
[2025-02-04 19:20:19 +0100] info [webmaild] 168.227.160.200 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.212.54
description:
Feb  4 19:20:25 ait sshd[106423]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.212.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.212.54
description:
Feb  4 19:20:25 ait sshd[106423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.212.54


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.27.23
description:
[2025-02-04 19:20:32 +0100] info [webmaild] 170.233.27.23 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.253.144.172
description:
[2025-02-04 19:20:49 +0100] info [webmaild] 38.253.144.172 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.219.169.212
description:
[2025-02-04 19:21:07 +0100] info [webmaild] 178.219.169.212 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  4 19:21:29 ait sshd[106770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  4 19:21:29 ait sshd[106770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.100.159
description:
Feb  4 19:22:29 ait sshd[107064]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.100.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  4 19:22:33 ait sshd[107084]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  4 19:22:33 ait sshd[107084]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.174.80.100
description:
[2025-02-04 19:23:00 +0100] info [webmaild] 78.174.80.100 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.79.223
description:
[2025-02-04 19:23:10 +0100] info [webmaild] 45.172.79.223 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.100.159
description:
Feb  4 19:22:29 ait sshd[107064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.100.159


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  4 19:23:20 ait sshd[107418]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-02-04 19:23:14 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (exolum) [2.139.88.148]:57512: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.114.154
description:
47.128.114.154 - - [04/Feb/2025:19:23:50 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10992431 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/be5f7f?panel=http_client" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.114.154


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.50.4.50
description:
[2025-02-04 19:23:44 +0100] info [webmaild] 196.50.4.50 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
description:
Feb  4 19:23:55 ait sshd[107556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.12
description:
Feb  4 19:24:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Feb  4 19:23:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  4 19:23:20 ait sshd[107418]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
description:
Feb  4 19:23:26 ait sshd[107425]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  4 19:23:25 ait sshd[107427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  4 19:23:25 ait sshd[107427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.51.193.79
description:
[2025-02-04 19:23:31 +0100] info [webmaild] 38.51.193.79 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
description:
Feb  4 19:23:55 ait sshd[107556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
description:
Feb  4 19:25:32 ait sshd[108944]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.73.223
description:
Feb  4 19:25:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.73.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.33.247.159
description:
Feb  4 19:24:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.33.247.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  4 19:25:02 ait sshd[108424]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.2.14
description:
Feb  4 19:25:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.2.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
description:
Feb  4 19:25:32 ait sshd[108944]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Feb  4 19:25:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.17.149.55
description:
[2025-02-04 19:25:38 +0100] info [webmaild] 201.17.149.55 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.73.223
description:
2025-02-04 19:25:42 dovecot_plain authenticator failed for ([27.188.73.223]) [27.188.73.223]:41344: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
description:
2025-02-04 19:25:30 dovecot_plain authenticator failed for ([125.35.109.214]) [125.35.109.214]:54639: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.173.106.95
description:
Feb  4 19:24:49 ait sshd[107933]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.173.106.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.35.109.214
description:
Feb  4 19:25:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.35.109.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-02-04 19:25:40 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:58514: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  4 19:26:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 19:25:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.14.129.138
description:
[2025-02-04 19:26:08 +0100] info [webmaild] 197.14.129.138 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
description:
Feb  4 19:26:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
description:
2025-02-04 19:26:45 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:54613: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.61.27
description:
[2025-02-04 19:26:21 +0100] info [webmaild] 157.100.61.27 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Feb  4 19:25:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-02-04 19:25:53 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:5184: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
description:
2025-02-04 19:26:40 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:44209: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
description:
Feb  4 19:26:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.132.185.213
description:
[2025-02-04 19:25:50 +0100] info [webmaild] 103.132.185.213 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-26.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.230
description:
Feb  4 19:26:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.230
description:
2025-02-04 19:26:33 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.230]:49658: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-02-04 19:27:16 dovecot_plain authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:41228: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Feb  4 19:27:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
description:
2025-02-04 19:27:29 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:58627: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-02-04 19:27:21 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:42516: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-02-04 19:27:24 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:42875: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Feb  4 19:27:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
description:
Feb  4 19:27:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-02-04 19:27:19 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:39098: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
description:
Feb  4 19:27:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
description:
2025-02-04 19:27:33 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:49824: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-02-04 19:27:33 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:54168: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-02-04 19:27:35 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:58398: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
description:
2025-02-04 19:27:08 dovecot_plain authenticator failed for ([36.110.161.134]) [36.110.161.134]:36050: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.138.18
description:
Feb  4 19:27:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.138.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
description:
Feb  4 19:27:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-02-04 19:27:21 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:45900: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
description:
Feb  4 19:27:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Feb  4 19:27:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
description:
2025-02-04 19:27:24 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:45884: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
description:
2025-02-04 19:27:36 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:52868: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-02-04 19:27:24 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:54525: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
description:
Feb  4 19:27:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-04 19:26:50 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:48551: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Feb  4 19:27:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
description:
Feb  4 19:27:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
description:
Feb  4 19:27:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Feb  4 19:27:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Feb  4 19:27:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
description:
Feb  4 19:27:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
description:
Feb  4 19:27:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.135
description:
2025-02-04 19:27:36 dovecot_plain authenticator failed for ([178.178.194.135]) [178.178.194.135]:55972: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.70.142
description:
Feb  4 19:27:01 ait sshd[109523]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
description:
Feb  4 19:27:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
description:
2025-02-04 19:27:16 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:50754: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Feb  4 19:27:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-02-04 19:27:31 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:58882: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
description:
2025-02-04 19:27:34 dovecot_plain authenticator failed for (187-50-150-169.customer.tdatabrasil.net.br) [187.50.67.114]:46910: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Feb  4 19:27:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  4 19:27:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-02-04 19:27:38 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:50384: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Feb  4 19:27:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
description:
Feb  4 19:27:22 ait sshd[109600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-04 19:27:35 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:43634: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
description:
2025-02-04 19:27:43 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:23090: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.68.225.143
description:
2025-02-04 19:27:30 dovecot_plain authenticator failed for s143-225-68-64.ssvec.az.wi-power.com [64.68.225.143]:57274: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-02-04 19:27:33 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:23748: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Feb  4 19:27:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
description:
2025-02-04 19:27:34 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:60648: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-02-04 19:27:20 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:55925: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
description:
Feb  4 19:27:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
description:
2025-02-04 19:27:30 dovecot_plain authenticator failed for ([36.26.63.158]) [36.26.63.158]:51693: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Feb  4 19:27:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Feb  4 19:27:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
description:
2025-02-04 19:27:44 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:54464: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-02-04 19:26:54 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:34880: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.70.142
description:
Feb  4 19:27:01 ait sshd[109523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.70.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Feb  4 19:27:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
description:
2025-02-04 19:27:23 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:40147: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
description:
Feb  4 19:27:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  4 19:27:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-04 19:27:33 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:39212: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-02-04 19:27:39 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:59566: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Feb  4 19:26:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  4 19:27:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.64.191
description:
2025-02-04 19:27:25 dovecot_plain authenticator failed for ([2.55.64.191]) [2.55.64.191]:48654: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.68.225.143
description:
Feb  4 19:27:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.68.225.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.209.109.213
description:
Feb  4 19:27:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.209.109.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-04 19:27:16 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:33992: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.64.191
description:
Feb  4 19:27:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.64.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Feb  4 19:27:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.135
description:
Feb  4 19:27:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.209.109.213
description:
2025-02-04 19:27:34 dovecot_plain authenticator failed for ([175.209.109.213]) [175.209.109.213]:46504: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.138.18
description:
2025-02-04 19:27:49 dovecot_plain authenticator failed for ([189.44.138.18]) [189.44.138.18]:38653: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
description:
Feb  4 19:27:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
description:
2025-02-04 19:27:18 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:44276: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
description:
2025-02-04 19:27:22 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:50814: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.57.10
description:
Feb  4 19:27:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.57.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
description:
2025-02-04 19:27:59 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:34139: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
description:
Feb  4 19:28:19 ait sshd[110027]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.245.126
description:
Feb  4 19:28:30 ait sshd[110075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.245.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
description:
Feb  4 19:27:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.209.224.48
description:
[2025-02-04 19:28:18 +0100] info [webmaild] 179.209.224.48 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  4 19:28:42 ait sshd[110108]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  4 19:28:42 ait sshd[110108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.117.179
description:
Feb  4 19:28:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.117.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.117.179
description:
2025-02-04 19:28:04 dovecot_plain authenticator failed for (abts-mum-static-179.117.70.182.airtelbroadband.in) [182.70.117.179]:54641: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.245.126
description:
Feb  4 19:28:30 ait sshd[110075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.245.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.146.112.178
description:
[2025-02-04 19:28:38 +0100] info [webmaild] 185.146.112.178 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
description:
2025-02-04 19:28:01 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:36358: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-29.118.67.214.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.165.111.183
description:
[2025-02-04 19:28:49 +0100] info [webmaild] 165.165.111.183 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.226.162.83
description:
[2025-02-04 19:29:12 +0100] info [webmaild] 186.226.162.83 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.27.217
description:
47.128.27.217 - - [04/Feb/2025:19:29:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15515368 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61&filter_course-language=79%2C198%2C121%2C118&filtering=1&instructor=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.27.217


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 19:29:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 19:30:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.182.71.73
description:
Feb  4 19:30:25 ait sshd[110872]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.182.71.73


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.58.172
description:
[2025-02-04 19:31:27 +0100] info [webmaild] 177.39.58.172 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
description:
Feb  4 19:30:53 ait sshd[110949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.8.130.131
description:
[2025-02-04 19:30:56 +0100] info [webmaild] 201.8.130.131 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.222.35.94
description:
[2025-02-04 19:31:16 +0100] info [webmaild] 177.222.35.94 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.133.195
description:
Feb  4 19:31:23 ait sshd[111343]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.133.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.133.195
description:
Feb  4 19:31:23 ait sshd[111343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.133.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
description:
Feb  4 19:30:53 ait sshd[110949]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.51.222.234
description:
Feb  4 19:31:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.51.222.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.77.16.251
description:
[2025-02-04 19:31:50 +0100] info [webmaild] 103.77.16.251 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Feb  4 19:32:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.162.249
description:
Feb  4 19:32:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.162.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.162.249
description:
2025-02-04 19:32:42 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:42801: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Feb  4 19:31:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-02-04 19:32:04 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:40142: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 19:32:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-02-04 19:31:55 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:43786: 535 Incorrect authentication data (set_id=test@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Feb  4 19:32:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-02-04 19:32:09 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:52234: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.51.222.234
description:
2025-02-04 19:31:48 dovecot_plain authenticator failed for a109-51-222-234.cpe.netcabo.pt [109.51.222.234]:40922: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  4 19:32:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-04 19:32:52 dovecot_plain authenticator failed for ([207.188.157.230]) [207.188.157.230]:5777: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Feb  4 19:33:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-02-04 19:33:24 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:54373: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Feb  4 19:33:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Feb  4 19:33:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.163.204.135
description:
[2025-02-04 19:33:35 +0100] info [webmaild] 200.163.204.135 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-02-04 19:33:35 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:61383: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-02-04 19:33:36 dovecot_plain authenticator failed for (uncedible) [91.116.42.218]:54554: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.242.194
description:
[2025-02-04 19:34:05 +0100] info [webmaild] 170.79.242.194 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.122.59.174
description:
[2025-02-04 19:34:28 +0100] info [webmaild] 187.122.59.174 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.152.18.41
description:
[2025-02-04 19:34:47 +0100] info [webmaild] 24.152.18.41 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 15.236.154.29
description:
Feb  4 19:35:01 ait sshd[112852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.236.154.29


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.165.16
description:
Feb  4 19:35:42 ait sshd[113132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.165.16


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.19.211.4
description:
Feb  4 19:36:12 ait sshd[113616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.19.211.4


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.129.11
description:
[2025-02-04 19:36:13 +0100] info [webmaild] 177.125.129.11 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.173.153.217
description:
[2025-02-04 19:36:45 +0100] info [webmaild] 190.173.153.217 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.19.211.4
description:
Feb  4 19:36:12 ait sshd[113616]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.19.211.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 19:36:40 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
description:
Feb  4 19:37:02 ait sshd[113790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
description:
Feb  4 19:37:02 ait sshd[113790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.154.182
description:
[2025-02-04 19:37:12 +0100] info [webmaild] 45.176.154.182 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.167.19
description:
[2025-02-04 19:37:31 +0100] info [webmaild] 90.156.167.19 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
description:
Feb  4 19:38:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  4 19:38:20 ait sshd[114258]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  4 19:38:20 ait sshd[114258]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
description:
2025-02-04 19:38:41 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:44836: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  4 19:38:21 ait sshd[114278]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  4 19:38:21 ait sshd[114278]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
description:
2025-02-04 19:38:52 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:36589: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.112.220.177
description:
[2025-02-04 19:39:42 +0100] info [webmaild] 200.112.220.177 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.233.26.143
description:
[2025-02-04 19:38:52 +0100] info [webmaild] 193.233.26.143 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
description:
Feb  4 19:39:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
description:
2025-02-04 19:39:31 dovecot_plain authenticator failed for ([39.88.252.16]) [39.88.252.16]:52722: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
description:
Feb  4 19:38:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Feb  4 19:39:08 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-02-04 19:39:10 dovecot_plain authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:51340: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.203.77.114
description:
[2025-02-04 19:39:23 +0100] info [webmaild] 152.203.77.114 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
description:
2025-02-04 19:40:09 dovecot_login authenticator failed for ([119.205.188.80]) [119.205.188.80]:34000: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
description:
2025-02-04 19:40:29 dovecot_login authenticator failed for ([45.117.10.134]) [45.117.10.134]:43384: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
description:
2025-02-04 19:40:40 dovecot_login authenticator failed for ([183.134.209.86]) [183.134.209.86]:33247: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
description:
2025-02-04 19:40:41 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:53026: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-02-04 19:40:20 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:46631: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
description:
Feb  4 19:40:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 143.110.180.0
description:
Feb  4 19:39:50 ait sshd[114723]: Failed password for invalid user simon from 143.110.180.0 port 50550 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
description:
Feb  4 19:40:07 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
description:
2025-02-04 19:40:09 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:33539: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.207.19.129
description:
[2025-02-04 19:40:15 +0100] info [webmaild] 190.207.19.129 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.203.9
description:
Feb  4 19:40:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.203.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.203.9
description:
2025-02-04 19:40:19 dovecot_login authenticator failed for ([121.188.203.9]) [121.188.203.9]:48575: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Feb  4 19:40:18 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.117.10.134
description:
Feb  4 19:40:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.117.10.134 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-40.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.134.209.86
description:
Feb  4 19:40:38 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.134.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
description:
Feb  4 19:39:48 ait sshd[114723]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
description:
Feb  4 19:39:48 ait sshd[114723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 19:40:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.152.64
description:
Feb  4 19:41:11 ait sshd[115497]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.197.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.23.102.164
description:
[2025-02-04 19:41:35 +0100] info [webmaild] 187.23.102.164 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.45.45.162
description:
Feb  4 19:40:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.45.45.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.45.162
description:
2025-02-04 19:40:52 dovecot_login authenticator failed for p385163-obmd01.tokyo.ocn.ne.jp [60.45.45.162]:52491: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.54.149.118
description:
Feb  4 19:41:18 ait sshd[115510]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.54.149.118  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.63.175
description:
Feb  4 19:41:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.63.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  4 19:41:34 ait sshd[115753]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 19:41:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
description:
2025-02-04 19:41:46 dovecot_plain authenticator failed for ([182.135.63.175]) [182.135.63.175]:51941: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.197.152.64
description:
Feb  4 19:41:11 ait sshd[115497]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.152.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.54.149.118
description:
Feb  4 19:41:18 ait sshd[115510]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.54.149.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  4 19:41:34 ait sshd[115753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.156.14
description:
Feb  4 19:42:05 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.156.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.156.14
description:
2025-02-04 19:42:07 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.156.14]:55636: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.229.27
description:
[2025-02-04 19:42:24 +0100] info [webmaild] 45.168.229.27 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 19:42:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.252.88
description:
[2025-02-04 19:42:05 +0100] info [webmaild] 45.172.252.88 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
description:
Feb  4 19:42:22 ait sshd[116015]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
description:
Feb  4 19:42:22 ait sshd[116015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.49.61.211
description:
Feb  4 19:42:55 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.49.61.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.235.35
description:
2025-02-04 19:43:11 dovecot_login authenticator failed for (ait.edu.gh) [131.161.235.35]:50786: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Feb  4 19:43:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.58.41
description:
[2025-02-04 19:42:58 +0100] info [webmaild] 138.204.58.41 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
description:
Feb  4 19:43:08 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
description:
2025-02-04 19:43:10 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:23081: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
description:
2025-02-04 19:43:30 dovecot_plain authenticator failed for (biophormula.static.gvt.net.br) [186.215.107.189]:60001: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  4 19:43:17 ait sshd[116348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-02-04 19:43:19 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:54485: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.49.61.211
description:
2025-02-04 19:42:57 dovecot_plain authenticator failed for ([136.49.61.211]) [136.49.61.211]:42796: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  4 19:43:17 ait sshd[116348]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
description:
Feb  4 19:43:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-44.118.67.214.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.207.231.183
description:
[2025-02-04 19:44:41 +0100] info [webmaild] 196.207.231.183 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Feb  4 19:44:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-02-04 19:44:46 dovecot_login authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:41960: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.248.192.204
description:
Feb  4 19:43:49 ait sshd[116469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.248.192.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 18.231.150.126
description:
Feb  4 19:44:36 ait sshd[116737]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.231.150.126


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Feb  4 19:44:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.248.192.204
description:
Feb  4 19:43:49 ait sshd[116469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.248.192.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.6.18.50
description:
[2025-02-04 19:44:13 +0100] info [webmaild] 189.6.18.50 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-02-04 19:44:48 dovecot_plain authenticator failed for (mencarier) [149.0.19.108]:49160: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
description:
Feb  4 19:44:53 ait sshd[116807]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
description:
Feb  4 19:44:53 ait sshd[116807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 57.128.47.31
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:19-45.57.128.47.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.52.137
description:
2025-02-04 19:45:01 dovecot_login authenticator failed for ([88.204.52.137]) [88.204.52.137]:58886: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 67.213.82.18
description:
Feb  4 19:44:56 ait sshd[116960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.213.82.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.90.189.46
description:
[2025-02-04 19:45:05 +0100] info [webmaild] 41.90.189.46 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.124.47.11
description:
Feb  4 19:45:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.124.47.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.124.47.11
description:
2025-02-04 19:45:30 dovecot_plain authenticator failed for ([111.124.47.11]) [111.124.47.11]:58837: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.82.18
description:
Feb  4 19:44:56 ait sshd[116960]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.213.82.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.204.52.137
description:
Feb  4 19:44:59 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.204.52.137 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.44.115.130
description:
[2025-02-04 19:45:39 +0100] info [webmaild] 110.44.115.130 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-02-04 19:46:02 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:51482: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
description:
Feb  4 19:46:13 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
description:
2025-02-04 19:46:15 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:55921: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.82.226.220
description:
Feb  4 19:46:22 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.82.226.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Feb  4 19:46:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.84.120
description:
Feb  4 19:46:45 ait sshd[117852]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.240.84.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-02-04 19:46:46 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:57638: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Feb  4 19:46:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.226.220
description:
2025-02-04 19:46:24 dovecot_plain authenticator failed for ([95.82.226.220]) [95.82.226.220]:43196: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.240.84.120
description:
Feb  4 19:46:45 ait sshd[117852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.240.84.120


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
description:
2025-02-04 19:47:07 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:46710: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.16.85.102
description:
Feb  4 19:47:15 ait sshd[118053]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.16.85.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Feb  4 19:47:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 94.72.109.35
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:19-47.94.72.109.35||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
description:
Feb  4 19:47:05 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.16.85.102
description:
Feb  4 19:47:15 ait sshd[118053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.16.85.102  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.44.48.84
description:
[2025-02-04 19:47:24 +0100] info [webmaild] 181.44.48.84 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.178.243.30
description:
[2025-02-04 19:46:53 +0100] info [webmaild] 201.178.243.30 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 19:47:40 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
description:
2025-02-04 19:47:40 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:38328: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Feb  4 19:47:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-02-04 19:47:22 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:35068: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-02-04 19:47:23 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:35288: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
description:
Feb  4 19:47:38 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.76.148
description:
2025-02-04 19:47:51 dovecot_plain authenticator failed for ([125.69.76.148]) [125.69.76.148]:49204: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.52.120.18
description:
[2025-02-04 19:48:26 +0100] info [webmaild] 77.52.120.18 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  4 19:48:32 ait sshd[118460]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  4 19:48:32 ait sshd[118460]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.76.148
description:
Feb  4 19:47:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.76.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.89.239.57
description:
[2025-02-04 19:47:52 +0100] info [webmaild] 196.89.239.57 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.125.64.126
description:
Feb  4 19:49:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.125.64.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.125.64.126
description:
2025-02-04 19:49:43 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:50608: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.228
description:
Feb  4 19:49:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.228
description:
2025-02-04 19:49:45 dovecot_plain authenticator failed for ([113.64.208.228]) [113.64.208.228]:57480: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.28.160.59
description:
[2025-02-04 19:49:30 +0100] info [webmaild] 176.28.160.59 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.159
description:
[2025-02-04 19:50:02 +0100] info [webmaild] 198.163.193.159 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Feb  4 19:50:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.181.220
description:
Feb  4 19:50:38 ait sshd[119309]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.247.181.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.247.181.220
description:
Feb  4 19:50:38 ait sshd[119309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.247.181.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.161.196.5
description:
Feb  4 19:49:57 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.161.196.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
description:
2025-02-04 19:49:59 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:50450: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Feb  4 19:50:06 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-02-04 19:50:08 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:23396: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-02-04 19:50:37 dovecot_login authenticator failed for ([58.230.236.82]) [58.230.236.82]:59068: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 43.245.86.30
description:
[2025-02-04 19:50:40 +0100] info [webmaild] 43.245.86.30 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Feb  4 19:51:01 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
description:
2025-02-04 19:51:37 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:45282: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.100.184.80
description:
Feb  4 19:51:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.100.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  4 19:50:54 ait sshd[119401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.194.71.195
description:
Feb  4 19:50:53 ait sshd[119426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.194.71.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
description:
Feb  4 19:51:03 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.252
description:
Feb  4 19:51:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  4 19:50:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.71.195
description:
Feb  4 19:50:53 ait sshd[119426]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.194.71.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-04 19:51:32 dovecot_plain authenticator failed for ([179.181.133.153]) [179.181.133.153]:47723: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.233.245
description:
Feb  4 19:50:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.233.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 19:50:54 ait sshd[119401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.252
description:
2025-02-04 19:51:18 dovecot_plain authenticator failed for ([211.247.127.252]) [211.247.127.252]:51092: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  4 19:51:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
description:
Feb  4 19:51:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.189.72.148
description:
Feb  4 19:51:44 ait sshd[119783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.189.72.148  user=ftp


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
description:
2025-02-04 19:51:45 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [101.100.184.80]:36486: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-04 19:50:53 dovecot_login authenticator failed for ([27.24.141.90]) [27.24.141.90]:48844: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-02-04 19:51:05 dovecot_login authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:44356: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.189.72.148
description:
Feb  4 19:51:44 ait sshd[119783]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.189.72.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.98.129.94
description:
[2025-02-04 19:51:13 +0100] info [webmaild] 103.98.129.94 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  4 19:51:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.233.245
description:
2025-02-04 19:50:53 dovecot_login authenticator failed for p46245-obmd01.osaka.ocn.ne.jp [153.141.233.245]:39304: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 19:51:27 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:34166: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-02-04 19:51:03 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:36517: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
description:
Feb  4 19:51:59 ait sshd[119828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.7.109.160
description:
Feb  4 19:52:33 ait sshd[120072]: pam_imunify(sshd:auth): [IM360_RBL] The IP 200.7.109.160 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.37.73.242
description:
Feb  4 19:52:42 ait sshd[120089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.37.73.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.72.212.113
description:
[2025-02-04 19:52:03 +0100] info [webmaild] 103.72.212.113 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Feb  4 19:51:55 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-02-04 19:51:56 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:35568: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Feb  4 19:51:54 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 200.7.109.160
description:
Feb  4 19:52:33 ait sshd[120072]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=200.7.109.160


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.152.137.63
description:
[2025-02-04 19:52:38 +0100] info [webmaild] 179.152.137.63 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.73.242
description:
Feb  4 19:52:42 ait sshd[120089]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.37.73.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-02-04 19:51:57 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com [98.10.121.246]:58064: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
description:
Feb  4 19:51:59 ait sshd[119828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.108
description:
2025-02-04 19:53:18 dovecot_plain authenticator failed for ([76.77.25.108]) [76.77.25.108]:50048: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.156.133
description:
Feb  4 19:53:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.156.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Feb  4 19:52:56 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-02-04 19:52:58 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:47916: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.108
description:
Feb  4 19:53:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.155.174.94
description:
[2025-02-04 19:53:18 +0100] info [webmaild] 105.155.174.94 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  4 19:53:28 ait sshd[120306]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  4 19:53:28 ait sshd[120306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
description:
Feb  4 19:53:36 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
description:
2025-02-04 19:53:38 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:38608: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.133
description:
2025-02-04 19:53:48 dovecot_plain authenticator failed for ([195.133.156.133]) [195.133.156.133]:44607: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.113.49
description:
[2025-02-04 19:53:50 +0100] info [webmaild] 186.233.113.49 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 19:54:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.177.167.194
description:
[2025-02-04 19:54:43 +0100] info [webmaild] 102.177.167.194 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  4 19:55:20 ait sshd[121018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  4 19:55:20 ait sshd[121018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-55.80.76.51.123


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.198
description:
Feb  4 19:55:25 ait dovecot[3957549]: pop3-login: Disconnected: Aborted login by logging out (no auth attempts in 5 secs): user=<>, rip=185.247.137.198, lip=136.243.145.84, TLS, session=<nBpCjVUtQd+594nG>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 175.107.224.187
description:
[2025-02-04 19:55:28 +0100] info [webmaild] 175.107.224.187 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 19:55:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Feb  4 19:56:05 ait sshd[121372]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
description:
2025-02-04 19:56:23 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:36130: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.171.150
description:
Feb  4 19:56:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.171.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.137.25
description:
2025-02-04 19:56:29 dovecot_plain authenticator failed for ([112.28.137.25]) [112.28.137.25]:50641: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  4 19:56:45 ait sshd[121683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
description:
2025-02-04 19:55:54 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:62393: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Feb  4 19:56:11 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-02-04 19:56:13 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:53769: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-02-04 19:56:20 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:48220: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Feb  4 19:56:18 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.137.25
description:
Feb  4 19:56:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.137.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.171.150
description:
2025-02-04 19:56:35 dovecot_plain authenticator failed for ([221.0.171.150]) [221.0.171.150]:43891: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  4 19:56:45 ait sshd[121683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.208.197
description:
Feb  4 19:56:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.208.197 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.68.212.2
description:
Feb  4 19:56:22 ait sshd[121527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.212.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
description:
Feb  4 19:55:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Feb  4 19:56:05 ait sshd[121372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.208.32.46
description:
[2025-02-04 19:56:15 +0100] info [webmaild] 154.208.32.46 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
description:
Feb  4 19:57:31 ait sshd[121988]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
description:
Feb  4 19:57:31 ait sshd[121988]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.47.167.126
description:
[2025-02-04 19:57:33 +0100] info [webmaild] 178.47.167.126 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.7.2.125
description:
[2025-02-04 19:57:00 +0100] info [webmaild] 38.7.2.125 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Feb  4 19:57:05 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-02-04 19:57:07 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (subablery) [81.16.170.117]:36054: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 19:57:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
description:
2025-02-04 19:57:57 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:52742: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-02-04 19:58:32 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:20560: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Feb  4 19:58:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-57.118.67.214.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
description:
Feb  4 19:57:55 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.186.17.150
description:
Feb  4 19:58:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.186.17.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
description:
Feb  4 19:58:27 ait sshd[122298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
description:
Feb  4 19:58:01 ait sshd[122056]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.111.18
description:
Feb  4 19:58:11 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.111.18 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.197.152.64
description:
Feb  4 19:58:39 ait sshd[122332]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.197.152.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  4 19:58:45 ait sshd[122345]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-02-04 19:58:48 dovecot_plain authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:59234: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  4 19:58:27 ait sshd[122298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.93.112.56
description:
[2025-02-04 19:58:05 +0100] info [webmaild] 181.93.112.56 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  4 19:58:28 ait sshd[122301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Feb  4 19:58:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 19:58:48 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.197.152.64
description:
Feb  4 19:58:39 ait sshd[122332]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.197.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
description:
Feb  4 19:58:01 ait sshd[122056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
description:
2025-02-04 19:58:43 dovecot_plain authenticator failed for ([162.186.17.150]) [162.186.17.150]:51231: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  4 19:58:45 ait sshd[122345]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.111.18
description:
2025-02-04 19:58:13 dovecot_plain authenticator failed for ([156.236.111.18]) [156.236.111.18]:35132: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Feb  4 19:58:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.201
description:
Feb  4 19:59:05 ait sshd[122459]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.201 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.201
description:
Feb  4 19:59:21 ait sshd[122459]: error: maximum authentication attempts exceeded for root from 218.92.0.201 port 20256 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.87.57
description:
[2025-02-04 19:59:24 +0100] info [webmaild] 45.224.87.57 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.84.68.214
description:
[2025-02-04 19:58:51 +0100] info [webmaild] 189.84.68.214 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-02-04 19:58:52 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:42134: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Feb  4 19:58:57 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-02-04 19:58:59 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:33583: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Feb  4 19:59:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-02-04 19:59:02 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:43028: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.201
description:
Feb  4 19:59:05 ait sshd[122459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.201  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.39.54
description:
Feb  4 20:00:40 ait sshd[123215]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.39.54


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.182.179.184
description:
[2025-02-04 20:00:04 +0100] info [webmaild] 177.182.179.184 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.21.253
description:
[2025-02-04 20:00:50 +0100] info [webmaild] 191.37.21.253 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.159.9
description:
[2025-02-04 20:01:24 +0100] info [webmaild] 170.239.159.9 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.104
description:
Feb  4 20:01:27 ait sshd[123422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.104  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
description:
Feb  4 20:01:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.133.214.161
description:
Feb  4 20:01:13 ait sshd[123391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.214.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 20:01:15 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.104
description:
Feb  4 20:01:27 ait sshd[123422]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
description:
2025-02-04 20:01:41 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:19982: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.124.145.199
description:
Feb  4 20:02:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.124.145.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.124.145.199
description:
2025-02-04 20:02:45 dovecot_plain authenticator failed for ([64.124.145.199]) [64.124.145.199]:58216: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
description:
Feb  4 20:01:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-02-04 20:01:54 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:49626: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 18.231.150.126
description:
Feb  4 20:01:56 ait sshd[123783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.231.150.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.250.130
description:
[2025-02-04 20:01:57 +0100] info [webmaild] 131.161.250.130 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.231.252.22
description:
[2025-02-04 20:02:44 +0100] info [webmaild] 37.231.252.22 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.120.150
description:
2025-02-04 20:02:56 dovecot_plain authenticator failed for 150.120.103.218.static.netvigator.com [218.103.120.150]:65077: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 20:03:03 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Feb  4 20:03:12 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.70
description:
Feb  4 20:03:23 ait sshd[124306]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.70


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Feb  4 20:03:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.103.120.150
description:
Feb  4 20:02:54 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.103.120.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-02-04 20:03:30 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:49899: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
description:
Feb  4 20:03:22 ait sshd[124298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  4 20:02:55 ait sshd[124184]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  4 20:02:55 ait sshd[124184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.181.17.177
description:
[2025-02-04 20:03:15 +0100] info [webmaild] 78.181.17.177 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.70
description:
Feb  4 20:03:23 ait sshd[124306]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
description:
Feb  4 20:03:22 ait sshd[124298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-02-04 20:03:14 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:36062: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Feb  4 20:04:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
description:
Feb  4 20:03:51 ait sshd[124572]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
description:
Feb  4 20:03:51 ait sshd[124572]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
description:
2025-02-04 20:04:25 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:44260: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Feb  4 20:04:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-02-04 20:04:35 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:51312: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-02-04 20:04:45 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:48362: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 20:04:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Feb  4 20:04:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.101.57.94
description:
[2025-02-04 20:04:10 +0100] info [webmaild] 92.101.57.94 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Feb  4 20:04:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-02-04 20:04:37 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:51938: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Feb  4 20:04:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-02-04 20:04:26 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:54460: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.44.92.220
description:
[2025-02-04 20:04:44 +0100] info [webmaild] 177.44.92.220 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Feb  4 20:05:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-02-04 20:05:44 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:56999: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.42.170
description:
Feb  4 20:04:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.42.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
description:
2025-02-04 20:04:51 dovecot_plain authenticator failed for ([116.132.42.170]) [116.132.42.170]:38964: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.185.79.87
description:
[2025-02-04 20:05:19 +0100] info [webmaild] 191.185.79.87 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.231.21.20
domain: iric.us
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Microsoft URL Control - 6.00.8862||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.128.55
description:
[2025-02-04 20:05:49 +0100] info [webmaild] 190.89.128.55 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.52.202.92
description:
Feb  4 20:05:53 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.52.202.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.52.202.92
description:
2025-02-04 20:05:55 dovecot_plain authenticator failed for ([123.52.202.92]) [123.52.202.92]:37074: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.165.16
description:
Feb  4 20:05:48 ait sshd[125634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.165.16


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  4 20:06:55 ait sshd[126025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.58.203
description:
Feb  4 20:07:12 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.58.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.134
description:
Feb  4 20:07:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.74.206.186
description:
[2025-02-04 20:07:28 +0100] info [webmaild] 177.74.206.186 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
description:
2025-02-04 20:07:26 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:44596: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 20:06:55 ait sshd[126025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Feb  4 20:07:02 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 20:07:02 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.212.194.6
description:
[2025-02-04 20:07:12 +0100] info [webmaild] 91.212.194.6 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.58.203
description:
2025-02-04 20:07:14 dovecot_plain authenticator failed for ([60.191.58.203]) [60.191.58.203]:32936: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.134
description:
2025-02-04 20:07:23 dovecot_plain authenticator failed for ([211.109.93.134]) [211.109.93.134]:55150: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-02-04 20:07:04 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:1543: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
description:
Feb  4 20:07:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.177.126.7
description:
[2025-02-04 20:08:27 +0100] info [webmaild] 182.177.126.7 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.2
description:
Feb  4 20:08:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.236.183
description:
Feb  4 20:08:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.236.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Feb  4 20:08:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.180.34
description:
Feb  4 20:08:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.180.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Feb  4 20:08:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
description:
2025-02-04 20:08:36 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:39362: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
description:
2025-02-04 20:08:36 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:48358: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
description:
2025-02-04 20:08:46 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:48854: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Feb  4 20:08:48 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-02-04 20:08:35 dovecot_plain authenticator failed for ([61.184.26.197]) [61.184.26.197]:33290: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-02-04 20:08:36 dovecot_plain authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:59704: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.180.34
description:
2025-02-04 20:08:41 dovecot_plain authenticator failed for ([218.14.180.34]) [218.14.180.34]:46701: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.235.244.59
description:
[2025-02-04 20:07:55 +0100] info [webmaild] 88.235.244.59 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
description:
Feb  4 20:08:01 ait sshd[126523]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
description:
Feb  4 20:08:01 ait sshd[126523]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
description:
Feb  4 20:08:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
description:
Feb  4 20:08:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.236.183
description:
2025-02-04 20:08:48 dovecot_plain authenticator failed for ([27.45.236.183]) [27.45.236.183]:35138: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-02-04 20:09:44 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:51208: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-02-04 20:09:44 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:59202: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 20:09:07 ait sshd[126800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Feb  4 20:09:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
description:
2025-02-04 20:09:27 dovecot_plain authenticator failed for ([130.250.134.35]) [130.250.134.35]:52668: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
description:
Feb  4 20:09:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-02-04 20:09:36 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:41593: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-04 20:09:43 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:56382: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Feb  4 20:09:45 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-02-04 20:09:26 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:57768: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-02-04 20:09:26 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:50746: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
description:
2025-02-04 20:09:27 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:50694: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-02-04 20:09:48 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:41967: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
description:
Feb  4 20:09:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Feb  4 20:09:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
description:
Feb  4 20:09:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-02-04 20:09:28 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:45964: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
description:
2025-02-04 20:09:29 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:60134: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
description:
Feb  4 20:09:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.210.10
description:
2025-02-04 20:09:04 dovecot_plain authenticator failed for ([27.45.210.10]) [27.45.210.10]:45998: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
description:
2025-02-04 20:09:29 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:50238: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-02-04 20:09:34 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:36962: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.2.45
description:
2025-02-04 20:09:37 dovecot_plain authenticator failed for static-193-217-2-45.cust.tele2.lt [193.217.2.45]:57407: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  4 20:09:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
description:
2025-02-04 20:09:33 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:14761: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-02-04 20:09:37 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:50398: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.89
description:
2025-02-04 20:09:41 dovecot_plain authenticator failed for ([119.207.83.89]) [119.207.83.89]:43335: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.52.253.175
description:
2025-02-04 20:09:44 dovecot_plain authenticator failed for ([111.52.253.175]) [111.52.253.175]:54752: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Feb  4 20:08:54 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Feb  4 20:09:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
description:
2025-02-04 20:09:34 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:58396: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.230
description:
Feb  4 20:09:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-02-04 20:09:44 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:37336: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
description:
2025-02-04 20:09:41 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:50342: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
description:
Feb  4 20:09:47 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-02-04 20:09:47 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:57800: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.102.233
description:
2025-02-04 20:09:43 dovecot_plain authenticator failed for ([183.236.102.233]) [183.236.102.233]:41830: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.20.197
description:
Feb  4 20:09:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.20.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
description:
Feb  4 20:09:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Feb  4 20:09:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
description:
2025-02-04 20:09:48 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:33696: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
description:
Feb  4 20:09:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Feb  4 20:09:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.0.112
description:
2025-02-04 20:09:35 dovecot_plain authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:38134: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.62
description:
2025-02-04 20:09:45 dovecot_plain authenticator failed for ([203.189.124.62]) [203.189.124.62]:46745: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
description:
2025-02-04 20:09:41 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:51282: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
description:
Feb  4 20:09:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Feb  4 20:09:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.21.113
description:
Feb  4 20:09:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.21.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.0.112
description:
Feb  4 20:09:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
description:
Feb  4 20:09:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
description:
Feb  4 20:09:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Feb  4 20:09:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-02-04 20:09:41 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:36380: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.62
description:
Feb  4 20:09:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-02-04 20:09:28 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:48628: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.83.89
description:
Feb  4 20:09:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.83.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Feb  4 20:09:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.194.148.132
description:
Feb  4 20:08:51 ait sshd[126770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.194.148.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
description:
2025-02-04 20:09:25 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:54612: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.136.240
description:
2025-02-04 20:09:29 dovecot_plain authenticator failed for 240.sub-97-212-136.myvzw.com [97.212.136.240]:34008: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
description:
2025-02-04 20:09:30 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:43738: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Feb  4 20:09:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.133.10.204
description:
Feb  4 20:09:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.133.10.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.7.248.50
description:
Feb  4 20:09:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.7.248.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-02-04 20:09:37 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:36606: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.57.205.7
description:
Feb  4 20:09:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.57.205.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-02-04 20:09:27 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:53540: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-02-04 20:09:31 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:36172: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-02-04 20:09:33 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:51240: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-02-04 20:09:35 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:43988: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-02-04 20:08:50 dovecot_plain authenticator failed for ([221.195.208.171]) [221.195.208.171]:18390: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
description:
Feb  4 20:09:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Feb  4 20:09:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Feb  4 20:09:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.7.248.50
description:
2025-02-04 20:09:31 dovecot_plain authenticator failed for ([116.7.248.50]) [116.7.248.50]:45704: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
description:
Feb  4 20:09:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Feb  4 20:09:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.230
description:
2025-02-04 20:09:44 dovecot_plain authenticator failed for ([27.40.100.230]) [27.40.100.230]:35084: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.2.45
description:
Feb  4 20:09:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.2.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.57.205.7
description:
2025-02-04 20:09:43 dovecot_plain authenticator failed for ([117.57.205.7]) [117.57.205.7]:59092: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
description:
2025-02-04 20:09:44 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:54821: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Feb  4 20:09:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.10.127.167
description:
2025-02-04 20:09:33 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:55479: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.52.253.175
description:
Feb  4 20:09:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.52.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.17.114
description:
2025-02-04 20:09:42 dovecot_plain authenticator failed for ([113.140.17.114]) [113.140.17.114]:33659: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
description:
Feb  4 20:09:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-02-04 20:08:56 dovecot_plain authenticator failed for (189-56-217-183.customer.tdatabrasil.net.br) [189.56.217.183]:55756: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
description:
Feb  4 20:09:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.145.172.49
description:
[2025-02-04 20:09:34 +0100] info [webmaild] 197.145.172.49 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Feb  4 20:09:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  4 20:09:07 ait sshd[126800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
description:
Feb  4 20:09:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.7.138
description:
2025-02-04 20:09:28 dovecot_plain authenticator failed for ([14.97.7.138]) [14.97.7.138]:58104: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Feb  4 20:09:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Feb  4 20:09:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.212.136.240
description:
Feb  4 20:09:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.212.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
description:
2025-02-04 20:09:37 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:49590: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.102.233
description:
Feb  4 20:09:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.102.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.69.242.122
description:
Feb  4 20:09:47 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.69.242.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-02-04 20:09:42 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:48088: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.21.113
description:
2025-02-04 20:09:32 dovecot_plain authenticator failed for ([117.158.21.113]) [117.158.21.113]:54152: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-02-04 20:09:32 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:56854: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Feb  4 20:09:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-02-04 20:09:48 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:47754: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.106.67.50
description:
Feb  4 20:09:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.106.67.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.17.114
description:
Feb  4 20:09:40 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.17.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Feb  4 20:09:40 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.20.197
description:
2025-02-04 20:09:46 dovecot_plain authenticator failed for ([65.76.20.197]) [65.76.20.197]:46176: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Feb  4 20:09:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
description:
2025-02-04 20:09:25 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:54738: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.7.138
description:
Feb  4 20:09:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.97.7.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-02-04 20:09:30 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:42905: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.10.127.167
description:
Feb  4 20:09:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.10.127.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.87.237
description:
2025-02-04 20:10:01 dovecot_plain authenticator failed for ([61.150.87.237]) [61.150.87.237]:45735: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-02-04 20:10:02 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:35504: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  4 20:10:16 ait sshd[127391]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  4 20:10:16 ait sshd[127391]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
description:
2025-02-04 20:09:49 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:38926: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.4.105
description:
Feb  4 20:10:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.4.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-02-04 20:09:56 dovecot_plain authenticator failed for ([220.248.205.14]) [220.248.205.14]:1237: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Feb  4 20:10:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.85.42.195
description:
2025-02-04 20:10:13 dovecot_plain authenticator failed for ([1.85.42.195]) [1.85.42.195]:44227: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.190.208.137
description:
[2025-02-04 20:10:35 +0100] info [webmaild] 182.190.208.137 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.68.194.54
description:
Feb  4 20:09:49 ait sshd[127085]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.68.194.54  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  4 20:09:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Feb  4 20:09:59 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.47.63.37
description:
Feb  4 20:10:01 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.47.63.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.226.255.240
description:
2025-02-04 20:10:04 dovecot_plain authenticator failed for ([58.226.255.240]) [58.226.255.240]:4954: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
description:
Feb  4 20:09:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.68.194.54
description:
Feb  4 20:09:49 ait sshd[127085]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.68.194.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-02-04 20:10:21 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:36048: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
description:
2025-02-04 20:10:01 dovecot_plain authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:52095: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.4.105
description:
2025-02-04 20:10:02 dovecot_plain authenticator failed for ([182.176.4.105]) [182.176.4.105]:50072: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.47.63.37
description:
2025-02-04 20:10:03 dovecot_plain authenticator failed for ([95.47.63.37]) [95.47.63.37]:49746: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-02-04 20:09:51 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:19978: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.138.69
description:
Feb  4 20:09:59 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.138.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.230.241
description:
[2025-02-04 20:10:11 +0100] info [webmaild] 38.156.230.241 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.69.242.122
description:
2025-02-04 20:09:49 dovecot_plain authenticator failed for ([101.69.242.122]) [101.69.242.122]:39235: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-02-04 20:09:54 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:60080: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-02-04 20:10:17 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:39250: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
description:
Feb  4 20:09:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Feb  4 20:09:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Feb  4 20:10:15 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Feb  4 20:09:58 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Feb  4 20:09:56 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Feb  4 20:09:54 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-02-04 20:10:38 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:40990: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
description:
2025-02-04 20:09:53 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:58036: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-02-04 20:09:58 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:12228: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 20:09:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Feb  4 20:10:36 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.87.237
description:
Feb  4 20:09:59 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.87.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-04 20:10:00 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:59288: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Feb  4 20:09:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
description:
Feb  4 20:09:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.26.106
description:
2025-02-04 20:09:51 dovecot_plain authenticator failed for ([58.240.26.106]) [58.240.26.106]:8770: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.85.42.195
description:
Feb  4 20:10:11 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.85.42.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.26.106
description:
Feb  4 20:09:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.26.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
description:
2025-02-04 20:09:53 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:37709: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-02-04 20:10:01 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:44719: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Feb  4 20:10:19 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-02-04 20:09:51 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:39454: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-04 20:09:54 dovecot_plain authenticator failed for ([218.1.239.146]) [218.1.239.146]:55640: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
description:
Feb  4 20:11:01 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
description:
2025-02-04 20:11:20 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:55902: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.78.179.108
description:
Feb  4 20:11:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.78.179.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.78.179.108
description:
2025-02-04 20:11:27 dovecot_plain authenticator failed for ([220.78.179.108]) [220.78.179.108]:55882: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-04 20:11:34 dovecot_plain authenticator failed for (dihobly) [81.211.77.58]:16456: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
description:
2025-02-04 20:11:03 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:51813: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-02-04 20:11:23 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:37098: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.5.76.239
description:
2025-02-04 20:11:23 dovecot_plain authenticator failed for ([112.5.76.239]) [112.5.76.239]:47497: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  4 20:11:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Feb  4 20:11:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-02-04 20:11:43 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:61010: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.188.215.34
description:
[2025-02-04 20:11:07 +0100] info [webmaild] 181.188.215.34 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
description:
Feb  4 20:11:12 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
description:
2025-02-04 20:11:14 dovecot_plain authenticator failed for ([23.237.83.130]) [23.237.83.130]:46296: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.5.76.239
description:
Feb  4 20:11:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.5.76.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
description:
Feb  4 20:11:18 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Feb  4 20:11:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-02-04 20:12:15 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:51960: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.248.192.204
description:
Feb  4 20:12:28 ait sshd[128260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.248.192.204


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.168.243
description:
Feb  4 20:12:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.168.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Feb  4 20:12:13 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
description:
Feb  4 20:12:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-12.118.67.214.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.68.122.11
description:
[2025-02-04 20:12:30 +0100] info [webmaild] 102.68.122.11 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.168.243
description:
2025-02-04 20:12:33 dovecot_plain authenticator failed for ([120.236.168.243]) [120.236.168.243]:55314: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.59.211.214
description:
Feb  4 20:12:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.59.211.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.59.211.214
description:
2025-02-04 20:12:46 dovecot_plain authenticator failed for ([201.59.211.214]) [201.59.211.214]:58383: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
description:
Feb  4 20:11:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-02-04 20:12:08 dovecot_plain authenticator failed for ([112.194.142.167]) [112.194.142.167]:41190: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
description:
2025-02-04 20:12:26 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:43015: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Feb  4 20:12:37 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Feb  4 20:12:06 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.202.24.117
description:
Feb  4 20:12:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.202.24.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.248.192.204
description:
Feb  4 20:12:28 ait sshd[128260]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.248.192.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.24.117
description:
2025-02-04 20:12:29 dovecot_plain authenticator failed for ([120.202.24.117]) [120.202.24.117]:34449: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-02-04 20:12:39 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:41225: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
description:
2025-02-04 20:11:51 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:54356: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.215.21.201
description:
[2025-02-04 20:13:34 +0100] info [webmaild] 5.215.21.201 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
description:
Feb  4 20:12:58 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
description:
Feb  4 20:13:27 ait sshd[128649]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-02-04 20:13:00 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:57592: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 110.39.163.118
description:
[2025-02-04 20:13:02 +0100] info [webmaild] 110.39.163.118 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
description:
Feb  4 20:13:27 ait sshd[128649]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-13.80.76.51.123


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
description:
Feb  4 20:14:19 ait sshd[129075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.105.246.224
description:
Feb  4 20:14:29 ait sshd[129154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.105.246.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.45.143.159
description:
Feb  4 20:14:43 ait sshd[128540]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.45.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.28.42
description:
[2025-02-04 20:14:06 +0100] info [webmaild] 179.6.28.42 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
description:
Feb  4 20:14:19 ait sshd[129075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.105.246.224
description:
Feb  4 20:14:29 ait sshd[129154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.105.246.224 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.45.143.159
description:
Feb  4 20:14:43 ait sshd[128540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.45.143.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-02-04 20:15:11 dovecot_login authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:58361: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.130
description:
Feb  4 20:15:22 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.2
description:
Feb  4 20:15:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
description:
Feb  4 20:15:03 ait sshd[129762]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  4 20:15:03 ait sshd[129762]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Feb  4 20:15:09 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.130
description:
2025-02-04 20:15:24 dovecot_login authenticator failed for ([211.109.93.130]) [211.109.93.130]:53122: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  4 20:15:33 ait sshd[129906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.160.128.46
description:
Feb  4 20:14:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.160.128.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.160.128.46
description:
2025-02-04 20:14:54 dovecot_plain authenticator failed for 46.79-160-128.customer.lyse.net [79.160.128.46]:35842: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.93
description:
47.128.116.93 - - [04/Feb/2025:20:14:55 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11535718 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=99%2C120%2C118&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.93


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
description:
Feb  4 20:14:58 ait sshd[129594]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
description:
Feb  4 20:14:58 ait sshd[129594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  4 20:15:33 ait sshd[129906]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.142.103.2
description:
[2025-02-04 20:15:15 +0100] info [webmaild] 102.142.103.2 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.200.110
description:
Feb  4 20:15:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.200.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.200.110
description:
2025-02-04 20:15:31 dovecot_plain authenticator failed for (103.163.200.110.dynamic-mytachyon.in) [103.163.200.110]:8435: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.2
description:
2025-02-04 20:15:45 dovecot_plain authenticator failed for ([183.220.243.2]) [183.220.243.2]:45400: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
description:
2025-02-04 20:15:57 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:46310: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Feb  4 20:16:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
description:
Feb  4 20:16:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
description:
Feb  4 20:16:18 ait sshd[130222]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
description:
Feb  4 20:16:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 20:16:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.214.147
description:
2025-02-04 20:16:36 dovecot_plain authenticator failed for host-ys.srk1-b.v4.dfn.nl [62.238.214.147]:43427: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.162.59
description:
2025-02-04 20:16:46 dovecot_plain authenticator failed for (223-197-162-59.static.imsbiz.com) [223.197.162.59]:62402: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-02-04 20:16:28 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:44128: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.126.120.5
description:
[2025-02-04 20:16:09 +0100] info [webmaild] 200.126.120.5 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-02-04 20:16:34 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:38772: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.228
description:
2025-02-04 20:16:46 dovecot_plain authenticator failed for ([113.64.208.228]) [113.64.208.228]:42601: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.24.117
description:
2025-02-04 20:16:48 dovecot_plain authenticator failed for ([120.202.24.117]) [120.202.24.117]:49258: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
description:
2025-02-04 20:16:26 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:44912: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Feb  4 20:16:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-02-04 20:16:29 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:46074: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Feb  4 20:16:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.228
description:
Feb  4 20:16:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.42.0.42
description:
[2025-02-04 20:15:52 +0100] info [webmaild] 186.42.0.42 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
description:
2025-02-04 20:16:28 dovecot_plain authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:38552: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-02-04 20:16:30 dovecot_plain authenticator failed for (unsess) [88.87.84.104]:47837: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
description:
2025-02-04 20:16:34 dovecot_plain authenticator failed for ([221.146.186.122]) [221.146.186.122]:35672: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.68.208
description:
Feb  4 20:16:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.125.68.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-02-04 20:16:45 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:52690: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Feb  4 20:16:47 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
description:
Feb  4 20:16:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
description:
2025-02-04 20:16:28 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:43541: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
description:
2025-02-04 20:16:28 dovecot_plain authenticator failed for ([113.193.187.154]) [113.193.187.154]:37614: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Feb  4 20:16:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.193.83
description:
2025-02-04 20:16:45 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:38423: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-02-04 20:16:49 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:37667: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Feb  4 20:16:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
description:
2025-02-04 20:16:31 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:19695: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Feb  4 20:16:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.214.147
description:
Feb  4 20:16:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.214.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
description:
2025-02-04 20:16:44 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:37438: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.217.183
description:
Feb  4 20:16:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.217.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-02-04 20:16:30 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:56755: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-02-04 20:16:34 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:54455: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  4 20:16:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.162.59
description:
Feb  4 20:16:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.162.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
description:
Feb  4 20:16:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
description:
Feb  4 20:16:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Feb  4 20:16:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-02-04 20:16:31 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:39164: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 20:16:35 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:45744: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.162.255.33
description:
[2025-02-04 20:16:41 +0100] info [webmaild] 45.162.255.33 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.193.83
description:
Feb  4 20:16:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.193.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
description:
Feb  4 20:15:55 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
description:
Feb  4 20:16:18 ait sshd[130222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.187.154
description:
Feb  4 20:16:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.187.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.217.183
description:
2025-02-04 20:16:32 dovecot_plain authenticator failed for (189-56-217-183.customer.tdatabrasil.net.br) [189.56.217.183]:60917: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.202.24.117
description:
Feb  4 20:16:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.202.24.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
description:
Feb  4 20:16:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
description:
Feb  4 20:16:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-04 20:16:43 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:60614: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
description:
2025-02-04 20:16:48 dovecot_plain authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:33874: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 20:16:51 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:55594: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.160
description:
Feb  4 20:16:55 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.160
description:
2025-02-04 20:16:57 dovecot_plain authenticator failed for ([218.149.228.160]) [218.149.228.160]:41316: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Feb  4 20:16:58 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 20:17:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-04 20:17:01 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:53948: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 20:16:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  4 20:17:32 ait sshd[130891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Feb  4 20:17:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 167.172.149.106
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:20-16.167.172.149.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
description:
Feb  4 20:17:14 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  4 20:17:32 ait sshd[130891]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
description:
Feb  4 20:17:38 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
description:
2025-02-04 20:17:40 dovecot_login authenticator failed for ([197.211.47.66]) [197.211.47.66]:49907: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
description:
Feb  4 20:16:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
description:
2025-02-04 20:16:52 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:49107: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-02-04 20:17:00 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:36925: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
description:
2025-02-04 20:17:16 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:56674: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Feb  4 20:16:59 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 20:18:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.58.103
description:
[2025-02-04 20:18:27 +0100] info [webmaild] 45.70.58.103 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  4 20:18:09 ait sshd[131255]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  4 20:18:09 ait sshd[131255]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
description:
Feb  4 20:18:25 ait sshd[131343]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
description:
Feb  4 20:18:25 ait sshd[131343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-02-04 20:17:51 dovecot_login authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:45989: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.136.189.45
description:
[2025-02-04 20:17:51 +0100] info [webmaild] 190.136.189.45 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 13.79.235.204
domain: ijari.us
description:
IM360 WAF: Block .suspected files||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/index.php.suspected||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.67.185.48
description:
Feb  4 20:19:13 ait sshd[131772]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.67.185.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.237.80.209
description:
[2025-02-04 20:19:40 +0100] info [webmaild] 190.237.80.209 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
description:
2025-02-04 20:19:46 dovecot_plain authenticator failed for ([158.140.38.21]) [158.140.38.21]:46793: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Feb  4 20:19:14 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.43.35
description:
Feb  4 20:19:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.43.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Feb  4 20:19:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
description:
Feb  4 20:19:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.87.169.64
description:
[2025-02-04 20:18:53 +0100] info [webmaild] 190.87.169.64 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Feb  4 20:19:05 ait sshd[131674]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 13.79.235.204
domain: ijari.us
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/gecko.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.67.185.48
description:
Feb  4 20:19:13 ait sshd[131772]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.67.185.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
description:
2025-02-04 20:19:25 dovecot_plain authenticator failed for ([154.127.43.35]) [154.127.43.35]:52146: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Feb  4 20:19:05 ait sshd[131674]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.79.235.204
domain: ijari.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/admin/upload/css.php||SC:/home/titlemas/public_html/ijari.us/admin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-02-04 20:19:16 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (fulponmic) [94.45.76.149]:46376: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-02-04 20:19:36 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:40950: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.243.10
description:
Feb  4 20:19:50 ait sshd[132069]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.165.243.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.165.243.10
description:
Feb  4 20:19:50 ait sshd[132069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.165.243.10


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.123.81
description:
47.128.123.81 - - [04/Feb/2025:20:19:55 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20661011" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.81


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.124
description:
47.128.59.124 - - [04/Feb/2025:20:20:15 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16006194 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?duration=long&filtering=1&level=expert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.124


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.159.71
description:
[2025-02-04 20:20:34 +0100] info [webmaild] 168.0.159.71 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
description:
2025-02-04 20:20:18 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:39487: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
description:
Feb  4 20:20:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
description:
2025-02-04 20:20:27 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:34430: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.59.245.133
description:
2025-02-04 20:20:34 dovecot_plain authenticator failed for 133.red-80-59-245.staticip.rima-tde.net [80.59.245.133]:46068: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.156.115.37
description:
Feb  4 20:20:02 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.156.115.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
description:
Feb  4 20:20:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.59.245.133
description:
Feb  4 20:20:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.59.245.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.115.37
description:
2025-02-04 20:20:04 dovecot_plain authenticator failed for ([197.156.115.37]) [197.156.115.37]:36958: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.52.51.242
description:
[2025-02-04 20:21:08 +0100] info [webmaild] 177.52.51.242 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.97.86
description:
47.128.97.86 - - [04/Feb/2025:20:21:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27260191 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/business-strategy/page/2/?filter_course-category=205&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.97.86


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.191.180
description:
Feb  4 20:21:19 ait sshd[132859]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.93.191.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.93.191.180
description:
Feb  4 20:21:19 ait sshd[132859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.191.180  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.121.185
description:
[2025-02-04 20:21:29 +0100] info [webmaild] 169.224.121.185 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.92.208.12
description:
2025-02-04 20:22:38 dovecot_plain authenticator failed for ([116.92.208.12]) [116.92.208.12]:58722: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.166.2
description:
Feb  4 20:21:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
description:
Feb  4 20:22:12 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-02-04 20:22:12 dovecot_login authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:42678: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  4 20:22:31 ait sshd[133482]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.166.2
description:
2025-02-04 20:21:53 dovecot_login authenticator failed for ([183.237.166.2]) [183.237.166.2]:39086: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Feb  4 20:22:10 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 20:22:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
description:
Feb  4 20:21:50 ait sshd[133091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.175.11.119
description:
Feb  4 20:22:36 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.175.11.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.42.163.252
description:
2025-02-04 20:22:40 dovecot_login authenticator failed for ([185.42.163.252]) [185.42.163.252]:37480: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
description:
Feb  4 20:21:50 ait sshd[133091]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-02-04 20:22:05 dovecot_login authenticator failed for ([196.28.226.66]) [196.28.226.66]:58988: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.92.208.12
description:
Feb  4 20:22:36 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.92.208.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.195.225.182
description:
Feb  4 20:22:47 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.195.225.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
description:
Feb  4 20:21:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.158.42.10
description:
[2025-02-04 20:22:03 +0100] info [webmaild] 201.158.42.10 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
description:
Feb  4 20:22:31 ait sshd[133482]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-02-04 20:22:14 dovecot_login authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:59326: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.42.163.252
description:
Feb  4 20:22:38 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.42.163.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
description:
2025-02-04 20:21:52 dovecot_login authenticator failed for ([60.216.37.11]) [60.216.37.11]:46034: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Feb  4 20:22:03 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.175.11.119
description:
2025-02-04 20:22:38 dovecot_login authenticator failed for (telemedia-ap-static-119.11.175.122.airtelbroadband.in) [122.175.11.119]:53370: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
description:
2025-02-04 20:23:10 dovecot_login authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:48545: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Feb  4 20:23:04 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Feb  4 20:23:15 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.195.225.182
description:
2025-02-04 20:22:49 dovecot_login authenticator failed for 123-195-225-182.dynamic.kbronet.com.tw [123.195.225.182]:60456: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-02-04 20:22:53 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:54794: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-02-04 20:23:17 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:53054: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.94.127.39
description:
[2025-02-04 20:23:22 +0100] info [webmaild] 138.94.127.39 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
description:
2025-02-04 20:23:30 dovecot_login authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:63507: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
description:
Feb  4 20:22:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-02-04 20:23:06 dovecot_login authenticator failed for ([112.48.104.200]) [112.48.104.200]:53511: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
description:
Feb  4 20:23:08 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 20:23:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
description:
Feb  4 20:23:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.118.230
description:
Feb  4 20:24:56 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.118.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
description:
2025-02-04 20:25:04 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:17111: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Feb  4 20:25:07 ait sshd[134914]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
description:
Feb  4 20:25:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.236.214
description:
Feb  4 20:25:41 ait sshd[135024]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.236.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.236.214
description:
Feb  4 20:25:41 ait sshd[135024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.236.214  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Feb  4 20:24:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.118.230
description:
2025-02-04 20:24:58 dovecot_login authenticator failed for ([182.70.118.230]) [182.70.118.230]:57495: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 20:25:05 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Feb  4 20:25:08 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-02-04 20:24:51 dovecot_plain authenticator failed for ([41.67.143.142]) [41.67.143.142]:34912: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
description:
Feb  4 20:25:02 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Feb  4 20:25:07 ait sshd[134914]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-02-04 20:25:10 dovecot_login authenticator failed for ([220.182.11.126]) [220.182.11.126]:52185: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
description:
2025-02-04 20:25:26 dovecot_login authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:58914: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Feb  4 20:26:02 ait sshd[135292]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
description:
Feb  4 20:26:05 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.25
description:
Feb  4 20:26:09 ait sshd[135327]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.2
description:
2025-02-04 20:26:23 dovecot_login authenticator failed for ([58.122.255.2]) [58.122.255.2]:33010: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.137.243
description:
[2025-02-04 20:25:58 +0100] info [webmaild] 45.161.137.243 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Feb  4 20:26:02 ait sshd[135292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
description:
2025-02-04 20:26:07 dovecot_login authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:34681: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.25
description:
Feb  4 20:26:09 ait sshd[135327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.25


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.74.115.210
description:
[2025-02-04 20:26:35 +0100] info [webmaild] 213.74.115.210 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.243.163
description:
Feb  4 20:26:05 ait sshd[135314]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.243.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.243.163
description:
Feb  4 20:26:05 ait sshd[135314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.243.163


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.2
description:
Feb  4 20:26:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.2 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  4 20:26:42 ait sshd[135451]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  4 20:26:46 ait sshd[135479]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  4 20:26:46 ait sshd[135479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
description:
Feb  4 20:27:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.105.190.16
description:
[2025-02-04 20:27:22 +0100] info [webmaild] 177.105.190.16 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  4 20:27:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-04 20:27:34 dovecot_login authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:21386: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-27.118.67.214.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
description:
2025-02-04 20:27:37 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:57297: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.32.233
description:
[2025-02-04 20:26:51 +0100] info [webmaild] 177.87.32.233 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Feb  4 20:27:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-02-04 20:27:36 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:37170: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
description:
Feb  4 20:27:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
description:
2025-02-04 20:28:22 dovecot_plain authenticator failed for ([201.18.75.41]) [201.18.71.134]:60610: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Feb  4 20:28:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
description:
2025-02-04 20:28:31 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:43078: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.220.167.38
description:
Feb  4 20:27:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.220.167.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 20:27:57 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-02-04 20:28:31 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:39666: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-02-04 20:28:41 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:47142: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.115.125
description:
Feb  4 20:27:49 ait sshd[136219]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.115.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Feb  4 20:28:01 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-02-04 20:28:17 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:44582: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Feb  4 20:28:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
description:
Feb  4 20:28:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
description:
Feb  4 20:28:20 ait sshd[136549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
description:
Feb  4 20:28:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
description:
2025-02-04 20:27:52 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:37541: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
description:
2025-02-04 20:27:54 dovecot_login authenticator failed for ([154.127.90.34]) [154.127.90.34]:52188: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.42.130.75
description:
[2025-02-04 20:28:38 +0100] info [webmaild] 179.42.130.75 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Feb  4 20:28:15 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 155.138.132.83
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-28.155.138.132.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-02-04 20:28:03 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:34806: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-02-04 20:28:22 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:62682: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
description:
Feb  4 20:28:20 ait sshd[136549]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Feb  4 20:28:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.115.125
description:
Feb  4 20:27:49 ait sshd[136219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.115.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 20:27:59 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:54451: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
description:
Feb  4 20:29:33 ait sshd[136924]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
description:
Feb  4 20:29:33 ait sshd[136924]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.34
description:
Feb  4 20:29:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-02-04 20:29:40 dovecot_login authenticator failed for ([221.161.16.240]) [221.161.16.240]:45169: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.131
description:
Feb  4 20:29:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-02-04 20:29:44 dovecot_login authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:11303: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.52.89.218
description:
2025-02-04 20:29:22 dovecot_plain authenticator failed for ([84.52.89.218]) [84.52.89.218]:53465: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.197.40.225
description:
[2025-02-04 20:29:26 +0100] info [webmaild] 181.197.40.225 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  4 20:29:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Feb  4 20:29:38 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.7.138
description:
Feb  4 20:28:48 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.97.7.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Feb  4 20:29:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.34
description:
2025-02-04 20:29:37 dovecot_login authenticator failed for ([185.167.56.34]) [185.167.56.34]:56532: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.131
description:
2025-02-04 20:29:45 dovecot_login authenticator failed for ([123.212.20.131]) [123.212.20.131]:49870: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.97.7.138
description:
2025-02-04 20:28:50 dovecot_plain authenticator failed for ([14.97.7.138]) [14.97.7.138]:38470: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.52.89.218
description:
Feb  4 20:29:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.52.89.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.105.210.229
description:
[2025-02-04 20:29:25 +0100] info [webmaild] 176.105.210.229 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-04 20:29:30 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:2849: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Feb  4 20:29:57 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-02-04 20:29:59 dovecot_login authenticator failed for ([95.0.252.78]) [95.0.252.78]:56620: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-02-04 20:30:18 dovecot_login authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:38251: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.13.237.163
description:
Feb  4 20:30:40 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.13.237.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
description:
Feb  4 20:30:06 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
description:
2025-02-04 20:30:08 dovecot_login authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:45017: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-02-04 20:29:57 dovecot_login authenticator failed for ([103.69.244.39]) [103.69.244.39]:43484: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.87.137.53
description:
[2025-02-04 20:29:59 +0100] info [webmaild] 181.87.137.53 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Feb  4 20:30:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  4 20:29:52 ait sshd[136970]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  4 20:29:52 ait sshd[136970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Feb  4 20:29:55 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.13.237.163
description:
2025-02-04 20:30:42 dovecot_plain authenticator failed for ([59.13.237.163]) [59.13.237.163]:51466: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.193.83
description:
Feb  4 20:30:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.193.83 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:20-30.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.193.83
description:
2025-02-04 20:30:52 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:52496: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 20:30:58 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.66.151.224
description:
[2025-02-04 20:31:22 +0100] info [webmaild] 102.66.151.224 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-02-04 20:32:19 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:51948: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.14.83.240
description:
[2025-02-04 20:32:40 +0100] info [webmaild] 201.14.83.240 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-04 20:32:40 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:58536: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  4 20:32:05 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.194.71.195
description:
Feb  4 20:32:10 ait sshd[138096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.194.71.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.106.29.86
description:
[2025-02-04 20:32:15 +0100] info [webmaild] 185.106.29.86 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Feb  4 20:32:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  4 20:32:38 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.154.107
description:
[2025-02-04 20:32:00 +0100] info [webmaild] 177.38.154.107 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-04 20:32:07 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:45586: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.71.195
description:
Feb  4 20:32:10 ait sshd[138096]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.194.71.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.29.121.21
description:
Feb  4 20:33:24 ait sshd[138564]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.29.121.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.171.150
description:
Feb  4 20:32:49 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.171.150 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 67.213.82.18
description:
Feb  4 20:32:56 ait sshd[138317]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.213.82.18  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
description:
Feb  4 20:33:10 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
description:
2025-02-04 20:33:12 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:52530: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Feb  4 20:33:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-02-04 20:33:22 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:58320: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.171.150
description:
2025-02-04 20:32:51 dovecot_plain authenticator failed for ([221.0.171.150]) [221.0.171.150]:58460: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.29.121.21
description:
Feb  4 20:33:24 ait sshd[138564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.29.121.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Feb  4 20:34:04 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Feb  4 20:33:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
description:
2025-02-04 20:33:56 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:51676: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 20:34:08 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.93.37.178
description:
Feb  4 20:34:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.93.37.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.158.58.22
description:
[2025-02-04 20:34:01 +0100] info [webmaild] 94.158.58.22 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-02-04 20:34:06 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:56016: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
description:
2025-02-04 20:34:09 dovecot_login authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:48338: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.93.37.178
description:
2025-02-04 20:34:32 dovecot_login authenticator failed for ([103.93.37.178]) [103.93.37.178]:45718: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.173.95.171
description:
[2025-02-04 20:34:40 +0100] info [webmaild] 152.173.95.171 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-02-04 20:34:40 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:41960: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
description:
Feb  4 20:33:54 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
description:
Feb  4 20:34:07 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
description:
2025-02-04 20:34:09 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:35538: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Feb  4 20:34:38 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-02-04 20:33:52 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:48535: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
description:
Feb  4 20:34:07 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.43.202.110
description:
Feb  4 20:35:09 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.43.202.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Feb  4 20:34:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-02-04 20:34:52 dovecot_login authenticator failed for ([41.216.169.13]) [41.216.169.13]:42078: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.98.56.191
description:
[2025-02-04 20:35:21 +0100] info [webmaild] 105.98.56.191 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.13.238
description:
2025-02-04 20:35:22 dovecot_login authenticator failed for ([183.234.13.238]) [183.234.13.238]:49946: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-02-04 20:35:10 dovecot_login authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:39429: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.13.238
description:
Feb  4 20:35:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.13.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.95.230.95
description:
2025-02-04 20:35:25 dovecot_login authenticator failed for ([210.95.230.95]) [210.95.230.95]:45624: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-02-04 20:35:47 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:8219: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 20:35:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-02-04 20:35:48 dovecot_login authenticator failed for (vipturbo.com.br) [191.36.152.249]:49631: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  4 20:34:57 ait sshd[138959]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
description:
2025-02-04 20:35:10 dovecot_login authenticator failed for ([121.147.25.111]) [121.147.25.111]:55556: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.95.230.95
description:
Feb  4 20:35:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.95.230.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-02-04 20:35:24 dovecot_login authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:7840: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.11.249
description:
Feb  4 20:35:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.11.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.57.33.221
description:
Feb  4 20:35:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.57.33.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  4 20:34:57 ait sshd[138959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
description:
Feb  4 20:35:08 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.43.202.110
description:
2025-02-04 20:35:11 dovecot_login authenticator failed for ([31.43.202.110]) [31.43.202.110]:41179: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.230.238
description:
Feb  4 20:35:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.230.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
description:
Feb  4 20:35:08 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Feb  4 20:35:22 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.11.249
description:
2025-02-04 20:35:30 dovecot_login authenticator failed for ([202.179.85.98]) [103.207.11.249]:33033: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
description:
Feb  4 20:35:45 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.24.16
description:
[2025-02-04 20:34:50 +0100] info [webmaild] 131.72.24.16 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Feb  4 20:35:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-02-04 20:35:30 dovecot_plain authenticator failed for (banied) [62.74.225.186]:34607: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.230.238
description:
2025-02-04 20:35:30 dovecot_login authenticator failed for ([222.170.230.238]) [222.170.230.238]:37345: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.57.33.221
description:
2025-02-04 20:35:44 dovecot_login authenticator failed for ([120.57.33.221]) [120.57.33.221]:40785: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.249
description:
Feb  4 20:35:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  4 20:36:31 ait sshd[139949]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-02-04 20:36:15 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:51474: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
description:
2025-02-04 20:36:19 dovecot_login authenticator failed for ([171.235.148.73]) [171.235.148.73]:52550: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.33.186.151
description:
Feb  4 20:36:32 ait sshd[139947]: pam_imunify(sshd:auth): [IM360_RBL] The IP 179.33.186.151 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 179.33.186.151
description:
Feb  4 20:36:32 ait sshd[139947]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.33.186.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
description:
2025-02-04 20:35:59 dovecot_login authenticator failed for ([39.174.90.48]) [39.174.90.43]:56125: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Feb  4 20:35:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
description:
Feb  4 20:35:57 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.183.1.82
description:
Feb  4 20:35:59 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.183.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.55.70.142
description:
Feb  4 20:36:07 ait sshd[139879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.55.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.183.1.82
description:
2025-02-04 20:36:01 dovecot_login authenticator failed for ([1.183.1.82]) [1.183.1.82]:46255: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  4 20:36:31 ait sshd[139949]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Feb  4 20:36:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-02-04 20:36:41 dovecot_login authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:25092: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Feb  4 20:36:13 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
description:
Feb  4 20:36:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-02-04 20:35:53 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:39030: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.55.70.142
description:
Feb  4 20:36:07 ait sshd[139879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.55.70.142  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.3.70.111
description:
[2025-02-04 20:36:42 +0100] info [webmaild] 188.3.70.111 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.94.206.187
description:
Feb  4 20:36:07 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.94.206.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
description:
2025-02-04 20:36:09 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:34596: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.235.201.146
description:
Feb  4 20:36:51 ait sshd[140015]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.235.201.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.187
description:
Feb  4 20:36:58 ait sshd[140026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.187  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Feb  4 20:37:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
description:
Feb  4 20:37:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-02-04 20:37:19 dovecot_plain authenticator failed for ([196.201.20.98]) [41.190.39.142]:58000: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
description:
2025-02-04 20:37:21 dovecot_login authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:56374: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Feb  4 20:37:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.223.17
description:
2025-02-04 20:37:47 dovecot_plain authenticator failed for ([111.75.223.17]) [111.75.223.17]:42369: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
description:
Feb  4 20:37:29 ait sshd[140476]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
description:
Feb  4 20:37:15 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-02-04 20:37:45 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:41030: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
description:
Feb  4 20:37:29 ait sshd[140476]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
description:
Feb  4 20:37:40 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Feb  4 20:37:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-02-04 20:37:47 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:50286: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Feb  4 20:37:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.26.197
description:
Feb  4 20:37:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.26.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 20:37:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-02-04 20:37:12 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:43134: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Feb  4 20:37:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
description:
2025-02-04 20:37:36 dovecot_login authenticator failed for ([94.205.86.48]) [94.205.86.48]:37403: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
description:
Feb  4 20:37:10 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-02-04 20:37:18 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:46231: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
description:
Feb  4 20:37:19 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.60
description:
2025-02-04 20:37:24 dovecot_plain authenticator failed for ([121.202.207.60]) [121.202.207.60]:4452: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-02-04 20:37:28 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:43806: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Feb  4 20:37:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 20:37:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
description:
2025-02-04 20:37:42 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:50791: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.187
description:
Feb  4 20:36:58 ait sshd[140026]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.207.60
description:
Feb  4 20:37:22 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.207.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.26.197
description:
2025-02-04 20:37:29 dovecot_login authenticator failed for ([61.184.26.197]) [61.184.26.197]:34306: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-02-04 20:37:29 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:19798: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.166.159.205
description:
[2025-02-04 20:37:31 +0100] info [webmaild] 152.166.159.205 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.75.223.17
description:
Feb  4 20:37:45 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.75.223.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Feb  4 20:37:45 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-02-04 20:37:17 dovecot_login authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:36361: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-02-04 20:37:25 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:51224: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
description:
2025-02-04 20:37:25 dovecot_login authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:38103: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.235.201.146
description:
Feb  4 20:36:51 ait sshd[140015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.235.201.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.227.22
description:
[2025-02-04 20:37:20 +0100] info [webmaild] 45.70.227.22 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.254.114
description:
Feb  4 20:37:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.254.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-02-04 20:38:31 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:51995: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.232.65
description:
Feb  4 20:38:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.232.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
description:
2025-02-04 20:38:33 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:32785: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  4 20:38:39 ait sshd[141075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-02-04 20:38:27 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:36140: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-02-04 20:38:37 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:8926: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-02-04 20:38:18 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:48559: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
description:
2025-02-04 20:38:31 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:32900: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Feb  4 20:38:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.235.201.146
description:
Feb  4 20:38:33 ait sshd[141059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.235.201.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
description:
Feb  4 20:38:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Feb  4 20:38:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.109.0.115
description:
Feb  4 20:38:13 ait sshd[140904]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.109.0.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
description:
Feb  4 20:38:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
description:
2025-02-04 20:38:35 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:41764: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Feb  4 20:38:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-02-04 20:38:28 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:40130: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-02-04 20:38:34 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:46316: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-02-04 20:38:37 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:20977: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
description:
2025-02-04 20:38:25 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:59604: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.62
description:
2025-02-04 20:38:25 dovecot_plain authenticator failed for ([203.189.124.62]) [203.189.124.62]:34293: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
description:
Feb  4 20:38:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
description:
2025-02-04 20:38:45 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:21423: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
description:
Feb  4 20:38:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.32.19.205
description:
Feb  4 20:38:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.32.19.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.146
description:
2025-02-04 20:38:25 dovecot_plain authenticator failed for ([180.94.75.146]) [180.94.75.146]:34982: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.230.179
description:
Feb  4 20:38:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.230.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.28.61
description:
Feb  4 20:38:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.28.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Feb  4 20:38:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Feb  4 20:38:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-02-04 20:38:39 dovecot_plain authenticator failed for ([103.109.44.163]) [122.165.137.159]:38744: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-02-04 20:38:41 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:57998: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
description:
2025-02-04 20:38:45 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:51782: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
description:
Feb  4 20:38:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-02-04 20:38:33 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:43086: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Feb  4 20:38:22 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.192.71.202
description:
Feb  4 20:38:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.192.71.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-02-04 20:38:26 dovecot_plain authenticator failed for ([112.194.142.167]) [112.194.142.167]:39154: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
description:
Feb  4 20:38:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
description:
Feb  4 20:38:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.32.19.205
description:
2025-02-04 20:38:23 dovecot_plain authenticator failed for 114-32-19-205.hinet-ip.hinet.net [114.32.19.205]:46428: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
description:
2025-02-04 20:38:18 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:54170: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-02-04 20:38:19 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:8192: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
description:
2025-02-04 20:38:33 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:35963: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Feb  4 20:38:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.54
description:
2025-02-04 20:38:28 dovecot_plain authenticator failed for (m121-202-154-54.smartone.com) [121.202.154.54]:11732: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
description:
2025-02-04 20:38:33 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:47975: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.30.127.9
description:
Feb  4 20:38:34 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.30.127.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.54
description:
Feb  4 20:38:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.69.242.122
description:
2025-02-04 20:38:26 dovecot_plain authenticator failed for ([101.69.242.122]) [101.69.242.122]:49733: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
description:
2025-02-04 20:38:31 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:37068: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-02-04 20:38:18 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:54750: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.28.61
description:
2025-02-04 20:38:23 dovecot_plain authenticator failed for ([60.173.88.145]) [111.39.28.61]:54364: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.133.195
description:
Feb  4 20:38:27 ait sshd[141032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.133.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-02-04 20:38:43 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:54476: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.230.179
description:
2025-02-04 20:38:22 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:35843: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.65.227.12
description:
Feb  4 20:38:40 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.65.227.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
description:
Feb  4 20:37:59 ait sshd[140647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
description:
Feb  4 20:38:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  4 20:38:45 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-02-04 20:38:30 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:44890: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.191.221.158
description:
Feb  4 20:38:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.191.221.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-04 20:38:18 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:56080: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
description:
2025-02-04 20:38:18 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:59904: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-02-04 20:38:18 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:44913: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.10.134
description:
2025-02-04 20:38:32 dovecot_plain authenticator failed for ([45.117.10.134]) [45.117.10.134]:37760: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.64.181
description:
[2025-02-04 20:37:58 +0100] info [webmaild] 138.0.64.181 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
description:
Feb  4 20:38:36 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.30.127.9
description:
2025-02-04 20:38:36 dovecot_plain authenticator failed for ([112.29.109.174]) [112.30.127.9]:43417: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
description:
Feb  4 20:38:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
description:
2025-02-04 20:38:36 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:18618: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
description:
2025-02-04 20:38:22 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:37587: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.126.214
description:
2025-02-04 20:38:23 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:43778: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.142
description:
2025-02-04 20:38:22 dovecot_plain authenticator failed for ([116.124.241.142]) [116.124.241.142]:43610: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
description:
Feb  4 20:37:59 ait sshd[140647]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Feb  4 20:38:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
description:
2025-02-04 20:38:33 dovecot_plain authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:46762: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  4 20:38:39 ait sshd[141075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Feb  4 20:38:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
description:
Feb  4 20:38:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Feb  4 20:38:19 ait sshd[140934]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
description:
Feb  4 20:38:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Feb  4 20:38:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Feb  4 20:37:50 ait sshd[140603]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  4 20:38:19 ait sshd[140934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.29.121.21
description:
Feb  4 20:38:17 ait sshd[140926]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.29.121.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.103
description:
Feb  4 20:38:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.57.60
description:
Feb  4 20:38:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.57.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-02-04 20:38:22 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:42772: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
description:
Feb  4 20:38:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
description:
Feb  4 20:38:47 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  4 20:38:11 ait sshd[140895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.207.60
description:
Feb  4 20:38:32 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.207.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Feb  4 20:38:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-04 20:38:30 dovecot_plain authenticator failed for ([103.65.227.71]) [114.130.181.74]:40475: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Feb  4 20:38:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.117.10.134
description:
Feb  4 20:38:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.117.10.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Feb  4 20:38:31 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
description:
2025-02-04 20:38:34 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:9737: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Feb  4 20:38:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.142
description:
Feb  4 20:38:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-04 20:38:47 dovecot_plain authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:21006: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.75.146
description:
Feb  4 20:38:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.75.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-02-04 20:38:30 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:58001: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Feb  4 20:38:37 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Feb  4 20:38:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
description:
Feb  4 20:38:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.29.121.21
description:
Feb  4 20:38:17 ait sshd[140926]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.29.121.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Feb  4 20:38:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-02-04 20:38:19 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:48076: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Feb  4 20:37:50 ait sshd[140603]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-02-04 20:38:41 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:39667: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.69.242.122
description:
Feb  4 20:38:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.69.242.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
description:
2025-02-04 20:38:02 dovecot_login authenticator failed for ([200.37.179.83]) [200.37.179.83]:57872: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.126.214
description:
Feb  4 20:38:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.126.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-02-04 20:38:37 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:48650: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 35.196.132.85
domain: www.hr.lemsas.net
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/.git/config):||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.21.113
description:
Feb  4 20:38:22 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.21.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.12
description:
2025-02-04 20:38:44 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:34639: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
description:
Feb  4 20:38:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.133.195
description:
Feb  4 20:38:27 ait sshd[141032]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.133.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
description:
Feb  4 20:38:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.103
description:
2025-02-04 20:38:41 dovecot_plain authenticator failed for 110-25-104-103.adsl.fetnet.net [110.25.104.103]:57226: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.75.223.17
description:
Feb  4 20:38:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.75.223.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
description:
2025-02-04 20:38:19 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:35852: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-02-04 20:38:24 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:53442: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
description:
Feb  4 20:38:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.235.201.146
description:
Feb  4 20:38:33 ait sshd[141059]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.235.201.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
description:
2025-02-04 20:38:43 dovecot_plain authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:57273: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Feb  4 20:38:25 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
description:
Feb  4 20:38:33 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  4 20:38:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Feb  4 20:38:35 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
description:
2025-02-04 20:38:27 dovecot_plain authenticator failed for ([124.134.109.253]) [124.134.109.253]:50384: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-02-04 20:38:23 dovecot_plain authenticator failed for ([39.165.236.12]) [39.165.236.12]:42132: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-02-04 20:38:43 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:47771: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-02-04 20:38:18 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:41512: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-02-04 20:38:23 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:48917: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-02-04 20:38:25 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:60890: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.109.0.115
description:
Feb  4 20:38:13 ait sshd[140904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.109.0.115


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.75.223.17
description:
2025-02-04 20:38:45 dovecot_plain authenticator failed for ([111.75.223.19]) [111.75.223.17]:49481: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  4 20:38:28 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
description:
2025-02-04 20:38:22 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:30289: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.62
description:
Feb  4 20:38:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Feb  4 20:38:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.12
description:
Feb  4 20:38:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  4 20:38:11 ait sshd[140895]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Feb  4 20:38:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
description:
2025-02-04 20:38:44 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:57926: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.207.60
description:
2025-02-04 20:38:34 dovecot_plain authenticator failed for ([121.202.207.60]) [121.202.207.60]:8165: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.37.179.83
description:
Feb  4 20:38:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.37.179.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
description:
Feb  4 20:38:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.192.71.202
description:
2025-02-04 20:38:35 dovecot_plain authenticator failed for ipbcc047ca.dynamic.kabel-deutschland.de [188.192.71.202]:41820: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.161.44.225
description:
Feb  4 20:38:03 ait sshd[140680]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.161.44.225  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.65.227.12
description:
2025-02-04 20:38:42 dovecot_plain authenticator failed for ([103.65.227.12]) [103.65.227.12]:57495: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-02-04 20:38:30 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:56294: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
description:
Feb  4 20:38:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Feb  4 20:38:39 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Feb  4 20:38:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.21.113
description:
2025-02-04 20:38:24 dovecot_plain authenticator failed for ([117.158.21.113]) [117.158.21.113]:40398: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.118.112.230
description:
Feb  4 20:38:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.118.112.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.44.225
description:
Feb  4 20:38:03 ait sshd[140680]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.161.44.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Feb  4 20:38:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Feb  4 20:38:41 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-04 20:38:32 dovecot_plain authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:42373: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
description:
2025-02-04 20:38:38 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:45669: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
description:
Feb  4 20:38:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Feb  4 20:38:21 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
description:
2025-02-04 20:38:22 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:43054: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Feb  4 20:39:01 ait sshd[141238]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.29.121.21
description:
Feb  4 20:39:48 ait sshd[141623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.29.121.21


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.33.186.151
description:
Feb  4 20:38:58 ait sshd[141214]: pam_imunify(sshd:auth): [IM360_RBL] The IP 179.33.186.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Feb  4 20:39:02 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Feb  4 20:38:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Feb  4 20:39:01 ait sshd[141238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-02-04 20:38:54 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:40454: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.92.187.68
description:
2025-02-04 20:38:50 dovecot_plain authenticator failed for ([172.92.187.68]) [172.92.187.68]:40256: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
description:
2025-02-04 20:38:49 dovecot_plain authenticator failed for ([148.102.73.4]) [148.102.76.10]:38654: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
description:
Feb  4 20:38:55 ait sshd[141209]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Feb  4 20:39:02 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.169.15
description:
[2025-02-04 20:39:27 +0100] info [webmaild] 45.181.169.15 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.226.113
description:
2025-02-04 20:38:59 dovecot_plain authenticator failed for ([94.207.226.113]) [94.207.226.113]:56572: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.97.90.143
description:
Feb  4 20:38:53 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.97.90.143 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 179.33.186.151
description:
Feb  4 20:38:58 ait sshd[141214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.33.186.151


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.81.117.20
description:
Feb  4 20:38:49 ait sshd[141160]: pam_imunify(sshd:auth): [IM360_RBL] The IP 86.81.117.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Feb  4 20:38:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-02-04 20:39:04 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:43461: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.29.121.21
description:
Feb  4 20:39:48 ait sshd[141623]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.29.121.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.92.187.68
description:
Feb  4 20:38:48 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.92.187.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 86.81.117.20
description:
Feb  4 20:38:49 ait sshd[141160]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=86.81.117.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-02-04 20:39:04 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:46007: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.97.90.143
description:
2025-02-04 20:38:55 dovecot_plain authenticator failed for ([180.97.90.143]) [180.97.90.143]:49477: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.226.113
description:
Feb  4 20:38:57 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.226.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 20:39:16 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-02-04 20:38:53 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:50973: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
description:
Feb  4 20:38:55 ait sshd[141209]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.235.201.146
description:
Feb  4 20:40:08 ait sshd[142032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.235.201.146


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.33.186.151
description:
Feb  4 20:40:27 ait sshd[142189]: pam_imunify(sshd:auth): [IM360_RBL] The IP 179.33.186.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Feb  4 20:40:36 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
description:
Feb  4 20:40:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.29.121.21
description:
Feb  4 20:39:51 ait sshd[141623]: Failed password for invalid user alex from 185.29.121.21 port 39598 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.131.159
description:
[2025-02-04 20:40:05 +0100] info [webmaild] 138.204.131.159 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.235.201.146
description:
Feb  4 20:40:08 ait sshd[142032]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.235.201.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 20:40:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.124.145.199
description:
Feb  4 20:40:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.124.145.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Feb  4 20:40:40 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Feb  4 20:40:43 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 20:40:48 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:45398: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 20:40:22 ait sshd[142166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.168
description:
Feb  4 20:40:23 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-02-04 20:40:38 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:42993: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.172
description:
Feb  4 20:39:59 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 179.33.186.151
description:
Feb  4 20:40:27 ait sshd[142189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=179.33.186.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-02-04 20:40:45 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:50327: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.99.64
description:
2025-02-04 20:40:48 dovecot_login authenticator failed for (64.99.86.116.starhub.net.sg) [116.86.99.64]:44022: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 20:40:22 ait sshd[142166]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-02-04 20:40:22 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:33290: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-02-04 20:40:42 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:45302: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Feb  4 20:40:30 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.124.145.199
description:
2025-02-04 20:40:32 dovecot_plain authenticator failed for (64.124.145.199.IDIA-283681-ZYO.zip.zayo.com) [64.124.145.199]:44268: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-02-04 20:40:32 dovecot_plain authenticator failed for ([149.0.19.108]) [149.0.19.108]:46556: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.183.45.16
description:
[2025-02-04 20:40:15 +0100] info [webmaild] 187.183.45.16 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Feb  4 20:40:20 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.99.64
description:
Feb  4 20:40:46 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.99.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.34.13
description:
[2025-02-04 20:40:47 +0100] info [webmaild] 170.245.34.13 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
description:
2025-02-04 20:40:48 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:41862: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
description:
2025-02-04 20:41:14 dovecot_plain authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:55670: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-02-04 20:41:03 dovecot_login authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:54340: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.77.118
description:
Feb  4 20:41:00 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.77.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-02-04 20:40:59 dovecot_plain authenticator failed for ([91.116.42.218]) [91.116.42.218]:41820: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.77.118
description:
2025-02-04 20:41:02 dovecot_plain authenticator failed for ([122.227.77.118]) [122.227.77.118]:41390: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.47.149.59
description:
Feb  4 20:41:12 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.47.149.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.140.13.84
description:
Feb  4 20:41:26 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.140.13.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
description:
Feb  4 20:41:29 ait sshd[142670]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
description:
Feb  4 20:41:29 ait sshd[142670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
description:
Feb  4 20:40:59 ait sshd[142349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Feb  4 20:41:01 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
description:
Feb  4 20:41:04 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
description:
2025-02-04 20:41:06 dovecot_plain authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:49856: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.140.13.84
description:
2025-02-04 20:41:28 dovecot_plain authenticator failed for (pool-37-140-13-84.is74.ru) [37.140.13.84]:54666: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Feb  4 20:40:57 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Feb  4 20:41:52 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.234.208
description:
Feb  4 20:41:57 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.234.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
description:
Feb  4 20:42:12 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Feb  4 20:42:15 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
description:
Feb  4 20:42:24 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.229.19.157
description:
Feb  4 20:42:42 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.229.19.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
description:
Feb  4 20:41:50 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.2.172
description:
Feb  4 20:42:29 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.2.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-02-04 20:42:17 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:60678: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-02-04 20:42:20 dovecot_login authenticator failed for ([115.247.159.106]) [115.247.159.106]:48068: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.110.229
description:
[2025-02-04 20:42:47 +0100] info [webmaild] 45.237.110.229 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
description:
2025-02-04 20:41:52 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:58264: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.173.63.71
description:
2025-02-04 20:41:58 dovecot_login authenticator failed for (ait.edu.gh) [78.173.63.71]:10196: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Feb  4 20:42:27 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.229.19.157
description:
2025-02-04 20:42:44 dovecot_login authenticator failed for ([45.229.19.157]) [45.229.19.157]:59256: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-02-04 20:41:54 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:52570: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-02-04 20:42:19 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:41280: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.92.138
description:
Feb  4 20:42:44 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.92.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Feb  4 20:42:17 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
description:
2025-02-04 20:42:26 dovecot_login authenticator failed for ([77.235.25.35]) [77.235.25.35]:53195: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.172
description:
2025-02-04 20:42:31 dovecot_login authenticator failed for ([31.173.2.172]) [31.173.2.172]:37620: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.115.253
description:
47.128.115.253 - - [04/Feb/2025:20:42:34 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=30217215 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/10/?filter_course-category=106&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.115.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.19
description:
2025-02-04 20:42:39 dovecot_plain authenticator failed for ([121.202.153.19]) [121.202.153.19]:25354: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.92.138
description:
2025-02-04 20:42:46 dovecot_login authenticator failed for ([61.150.92.138]) [61.150.92.138]:45066: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 20:41:51 ait auth[113255]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


