# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.28.189.169
description:
[2025-02-05 11:15:16 +0100] info [webmaild] 5.28.189.169 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Feb  5 11:15:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.38.62.253
description:
[2025-02-05 11:14:29 +0100] info [webmaild] 187.38.62.253 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
description:
Feb  5 11:14:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-02-05 11:15:22 dovecot_login authenticator failed for ([103.190.91.113]) [103.190.91.113]:41881: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.131.44.28
description:
[2025-02-05 11:14:41 +0100] info [webmaild] 37.131.44.28 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-05 11:14:59 dovecot_login authenticator failed for ([159.223.250.131]) [161.35.200.202]:59472: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
description:
2025-02-05 11:15:05 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:63510: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-02-05 11:15:21 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:47725: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Feb  5 11:14:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  5 11:14:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  5 11:14:58 ait sshd[492093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Feb  5 11:15:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
description:
2025-02-05 11:14:42 dovecot_plain authenticator failed for ([83.136.176.12]) [83.136.176.12]:54112: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-05 11:15:00 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:55302: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-02-05 11:15:12 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:43658: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Feb  5 11:15:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
description:
2025-02-05 11:15:00 dovecot_plain authenticator failed for ([103.190.91.99]) [103.190.91.99]:51520: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-02-05 11:14:46 dovecot_plain authenticator failed for (nogion) [102.53.15.54]:48753: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  5 11:14:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  5 11:14:58 ait sshd[492093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
description:
2025-02-05 11:15:39 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:39498: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.60.88
description:
2025-02-05 11:15:44 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.60.88]:14126: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.178.158
description:
2025-02-05 11:15:49 dovecot_plain authenticator failed for (200-168-190-25.customer.tdatabrasil.net.br) [189.56.178.158]:42032: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.49.61.211
description:
2025-02-05 11:15:56 dovecot_plain authenticator failed for ([136.49.61.211]) [136.49.61.211]:51936: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
description:
2025-02-05 11:16:03 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:40635: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-02-05 11:16:10 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:55710: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  5 11:15:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-02-05 11:15:36 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:59038: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-02-05 11:15:38 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2225: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
description:
2025-02-05 11:15:44 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:40528: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.156.254
description:
Feb  5 11:15:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.156.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.235.100.6
description:
Feb  5 11:15:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.235.100.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
description:
2025-02-05 11:16:03 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:42212: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Feb  5 11:15:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.140.212.144
description:
2025-02-05 11:15:33 dovecot_plain authenticator failed for ([5.140.212.144]) [5.140.212.144]:1299: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Feb  5 11:15:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.235.100.6
description:
2025-02-05 11:15:51 dovecot_plain authenticator failed for host-105-235-100-6.afnet.net [105.235.100.6]:40699: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-02-05 11:16:13 dovecot_plain authenticator failed for ([218.22.187.69]) [218.22.187.66]:39789: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-02-05 11:15:40 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:39994: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.178.158
description:
Feb  5 11:15:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.178.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.129.26
description:
2025-02-05 11:15:55 dovecot_plain authenticator failed for bb115-66-129-26.singnet.com.sg [115.66.129.26]:52230: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.212
description:
2025-02-05 11:16:00 dovecot_plain authenticator failed for 212.42.246.220.static.netvigator.com [220.246.42.212]:65438: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
description:
Feb  5 11:16:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-02-05 11:15:38 dovecot_plain authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:45780: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
description:
2025-02-05 11:15:45 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:60780: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
description:
2025-02-05 11:15:51 dovecot_plain authenticator failed for ([111.225.207.166]) [111.225.207.166]:38258: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
description:
2025-02-05 11:16:13 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:60027: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-02-05 11:15:37 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:48819: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.164.217.166
description:
Feb  5 11:15:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.164.217.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.49.61.211
description:
Feb  5 11:15:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.49.61.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Feb  5 11:16:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.225.207.166
description:
Feb  5 11:15:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.225.207.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.129.26
description:
Feb  5 11:15:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.129.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Feb  5 11:15:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Feb  5 11:15:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
description:
Feb  5 11:15:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
description:
2025-02-05 11:15:50 dovecot_plain authenticator failed for mail.toptronicsinc.com [218.4.156.254]:42757: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-02-05 11:15:54 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:47597: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
description:
Feb  5 11:16:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
description:
2025-02-05 11:15:36 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:35412: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
description:
Feb  5 11:15:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Feb  5 11:16:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Feb  5 11:15:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Feb  5 11:15:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-02-05 11:15:51 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:41859: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Feb  5 11:15:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
description:
Feb  5 11:15:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-02-05 11:15:35 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:55410: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Feb  5 11:15:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
description:
Feb  5 11:16:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Feb  5 11:16:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Feb  5 11:16:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Feb  5 11:15:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.212
description:
Feb  5 11:15:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.140.212.144
description:
Feb  5 11:15:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.140.212.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Feb  5 11:15:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.168.106
description:
2025-02-05 11:15:36 dovecot_plain authenticator failed for ([124.115.168.106]) [124.115.168.106]:56744: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.84.60.88
description:
Feb  5 11:15:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.84.60.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-02-05 11:16:07 dovecot_plain authenticator failed for (189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:37282: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-02-05 11:16:23 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:46559: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.164.217.166
description:
2025-02-05 11:15:50 dovecot_plain authenticator failed for ([119.164.217.166]) [119.164.217.166]:7380: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-02-05 11:15:34 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:38972: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.168.106
description:
Feb  5 11:15:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.168.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.9.146
description:
2025-02-05 11:15:35 dovecot_plain authenticator failed for ([180.166.163.26]) [58.246.9.146]:43550: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-05 11:15:37 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:36219: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
description:
2025-02-05 11:15:40 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:50414: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
description:
Feb  5 11:15:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.132.137.230
description:
Feb  5 11:15:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.132.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Feb  5 11:15:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.9.146
description:
Feb  5 11:15:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.9.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-02-05 11:15:33 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:54356: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
description:
Feb  5 11:15:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.132.137.230
description:
2025-02-05 11:15:49 dovecot_plain authenticator failed for (static-137-230.pppoe.tmb.ru) [78.132.137.230]:53896: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-02-05 11:15:57 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:53234: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Feb  5 11:16:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
description:
Feb  5 11:16:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.229.158.178
description:
[2025-02-05 11:16:45 +0100] info [webmaild] 200.229.158.178 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-02-05 11:16:47 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:49173: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-02-05 11:16:58 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:60850: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  5 11:17:02 ait sshd[493063]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 11:17:02 ait sshd[493063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-02-05 11:16:35 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:49112: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Feb  5 11:16:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.41
description:
[2025-02-05 11:17:18 +0100] info [webmaild] 84.54.71.41 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.163.176.26
description:
[2025-02-05 11:17:36 +0100] info [webmaild] 109.163.176.26 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.222.248
description:
[2025-02-05 11:18:12 +0100] info [webmaild] 45.165.222.248 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 11:18:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.117.119.210
description:
[2025-02-05 11:19:55 +0100] info [webmaild] 138.117.119.210 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 11:20:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
description:
2025-02-05 11:20:57 dovecot_login authenticator failed for ([185.167.58.9]) [185.167.58.9]:59434: 535 Incorrect authentication data (set_id=visa@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.82
description:
2025-02-05 11:21:09 dovecot_login authenticator failed for ([183.249.1.82]) [183.249.1.82]:32784: 535 Incorrect authentication data (set_id=visa)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.223.47.8
description:
Feb  5 11:20:40 ait sshd[494809]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.223.47.8 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.223.47.8
description:
Feb  5 11:20:40 ait sshd[494809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.47.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
description:
Feb  5 11:20:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.82
description:
Feb  5 11:21:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.63.205.134
description:
[2025-02-05 11:20:39 +0100] info [webmaild] 92.63.205.134 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.173
description:
[2025-02-05 11:21:13 +0100] info [webmaild] 213.230.87.173 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-02-05 11:22:11 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:49880: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
description:
Feb  5 11:22:16 ait sshd[495600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
description:
Feb  5 11:22:16 ait sshd[495600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Feb  5 11:22:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  5 11:21:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-05 11:21:41 dovecot_plain authenticator failed for (ticalitich) [46.30.161.197]:54733: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 11:22:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-02-05 11:22:22 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:44284: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.183.59.250
description:
[2025-02-05 11:21:53 +0100] info [webmaild] 187.183.59.250 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Feb  5 11:22:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.37.96
description:
[2025-02-05 11:22:24 +0100] info [webmaild] 191.99.37.96 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
description:
Feb  5 11:22:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
description:
2025-02-05 11:22:52 dovecot_plain authenticator failed for ([218.6.160.15]) [218.6.160.15]:51175: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Feb  5 11:22:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-02-05 11:23:01 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:59366: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
description:
2025-02-05 11:23:11 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:43658: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
description:
Feb  5 11:23:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.117.63.145
description:
[2025-02-05 11:23:15 +0100] info [webmaild] 45.117.63.145 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 11:23:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
description:
Feb  5 11:23:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
description:
2025-02-05 11:23:55 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:59926: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
description:
Feb  5 11:23:57 ait sshd[496516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
description:
Feb  5 11:23:57 ait sshd[496516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.32.31
description:
[2025-02-05 11:23:49 +0100] info [webmaild] 190.114.32.31 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-05 11:25:25 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:36222: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.24
description:
[2025-02-05 11:24:32 +0100] info [webmaild] 84.54.70.24 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 11:24:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  5 11:25:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.174.215.45
description:
[2025-02-05 11:25:02 +0100] info [webmaild] 103.174.215.45 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Feb  5 11:25:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
description:
2025-02-05 11:26:11 dovecot_login authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:24918: 535 Incorrect authentication data (set_id=iric@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.129.199
description:
Feb  5 11:26:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.129.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
description:
2025-02-05 11:26:17 dovecot_login authenticator failed for ([61.145.163.164]) [61.145.163.164]:39796: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.54.113
description:
[2025-02-05 11:26:23 +0100] info [webmaild] 45.5.54.113 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Feb  5 11:26:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-05 11:26:22 dovecot_plain authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:57796: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.140.142.40
description:
Feb  5 11:26:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.140.142.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
description:
Feb  5 11:26:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  5 11:26:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
description:
Feb  5 11:26:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.129.199
description:
2025-02-05 11:26:14 dovecot_plain authenticator failed for ([203.172.129.199]) [203.172.129.199]:47856: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-02-05 11:26:18 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:43104: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
description:
2025-02-05 11:26:21 dovecot_login authenticator failed for ([177.174.89.105]) [177.174.89.99]:43748: 535 Incorrect authentication data (set_id=iric)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.136.97.11
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-25.193.136.97.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-02-05 11:25:36 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:42394: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.9.139
description:
[2025-02-05 11:25:50 +0100] info [webmaild] 169.224.9.139 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
description:
Feb  5 11:26:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.142.40
description:
2025-02-05 11:26:28 dovecot_login authenticator failed for ([103.106.192.161]) [103.140.142.40]:39094: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-02-05 11:26:30 dovecot_plain authenticator failed for ([121.202.152.7]) [121.202.152.7]:18907: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.232.13.56
description:
[2025-02-05 11:27:07 +0100] info [webmaild] 88.232.13.56 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Feb  5 11:26:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-02-05 11:28:20 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:41148: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.232.143
description:
[2025-02-05 11:28:25 +0100] info [webmaild] 181.94.232.143 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 11:27:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.82.203.52
description:
[2025-02-05 11:27:38 +0100] info [webmaild] 103.82.203.52 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.176.208
description:
Feb  5 11:27:42 ait sshd[498158]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.176.208


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.176.208
description:
Feb  5 11:27:42 ait sshd[498158]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.176.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Feb  5 11:28:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-05 11:29:26 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:47209: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.141.229
description:
Feb  5 11:28:28 ait sshd[498559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.141.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.137.177.243
description:
[2025-02-05 11:28:59 +0100] info [webmaild] 91.137.177.243 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.141.229
description:
Feb  5 11:28:28 ait sshd[498559]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.141.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-02-05 11:28:32 dovecot_plain authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:57058: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
description:
Feb  5 11:28:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 217.182.158.226
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-28.217.182.158.226


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
description:
Feb  5 11:28:54 ait sshd[498778]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
description:
Feb  5 11:28:54 ait sshd[498778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-28.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  5 11:29:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.19.69
description:
2025-02-05 11:29:43 dovecot_plain authenticator failed for ([154.73.19.69]) [154.73.19.69]:52831: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.188
description:
[2025-02-05 11:30:18 +0100] info [cpaneld] 156.228.114.188 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.254.136.116
description:
Feb  5 11:29:34 ait sshd[498936]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.136.116  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.88
description:
[2025-02-05 11:30:25 +0100] info [cpaneld] 156.228.91.88 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.28
description:
[2025-02-05 11:30:18 +0100] info [cpaneld] 156.228.85.28 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.107
description:
[2025-02-05 11:30:23 +0100] info [cpaneld] 104.207.56.107 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs4 (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  5 11:29:51 ait sshd[499271]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  5 11:29:51 ait sshd[499271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.194
description:
[2025-02-05 11:30:16 +0100] info [cpaneld] 104.207.50.194 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.97.83
description:
[2025-02-05 11:30:18 +0100] info [cpaneld] 156.228.97.83 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.172
description:
[2025-02-05 11:30:26 +0100] info [whostmgrd] 156.228.91.172 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.229
description:
[2025-02-05 11:30:27 +0100] info [cpaneld] 104.207.55.229 - abs1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.52
description:
[2025-02-05 11:30:26 +0100] info [cpaneld] 156.228.118.52 - abs2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs2 (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.254.136.116
description:
Feb  5 11:29:34 ait sshd[498936]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.254.136.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.73.19.69
description:
Feb  5 11:29:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.73.19.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.162.252.176
description:
[2025-02-05 11:29:48 +0100] info [webmaild] 188.162.252.176 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.22.54.48
description:
[2025-02-05 11:30:18 +0100] info [webmaild] 187.22.54.48 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.171
description:
[2025-02-05 11:30:22 +0100] info [cpaneld] 104.207.50.171 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs3 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 11:31:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 11:31:15 dovecot_plain authenticator failed for ([27.223.100.94]) [27.223.100.90]:57058: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.124
description:
[2025-02-05 11:30:31 +0100] info [cpaneld] 156.228.101.124 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.42.236
description:
[2025-02-05 11:30:37 +0100] info [whostmgrd] 104.207.42.236 - abs2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.232.125.144
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-30.165.232.125.144


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.188
description:
[2025-02-05 11:30:37 +0100] info [whostmgrd] 156.228.114.188 - abs2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.185
description:
[2025-02-05 11:30:42 +0100] info [whostmgrd] 104.207.58.185 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.60
description:
[2025-02-05 11:30:45 +0100] info [whostmgrd] 104.207.54.60 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
description:
2025-02-05 11:30:53 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:37134: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.117.34
description:
[2025-02-05 11:30:32 +0100] info [cpaneld] 156.228.117.34 - abs2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.167
description:
[2025-02-05 11:30:34 +0100] info [whostmgrd] 104.207.54.167 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.52
description:
[2025-02-05 11:30:38 +0100] info [cpaneld] 156.228.80.52 - abs1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.37.16
description:
[2025-02-05 11:30:49 +0100] info [whostmgrd] 104.207.37.16 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.96.177
description:
[2025-02-05 11:30:33 +0100] info [whostmgrd] 156.228.96.177 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.54
description:
[2025-02-05 11:30:35 +0100] info [cpaneld] 104.207.35.54 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.203
description:
[2025-02-05 11:30:35 +0100] info [whostmgrd] 156.228.125.203 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.49.150
description:
[2025-02-05 11:30:34 +0100] info [whostmgrd] 104.207.49.150 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.118.112.230
description:
Feb  5 11:30:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.118.112.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.76.172
description:
[2025-02-05 11:30:50 +0100] info [whostmgrd] 156.228.76.172 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Feb  5 11:30:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.99.18
description:
[2025-02-05 11:30:28 +0100] info [whostmgrd] 156.228.99.18 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.196
description:
[2025-02-05 11:30:30 +0100] info [cpaneld] 156.228.78.196 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.61.118
description:
[2025-02-05 11:30:31 +0100] info [whostmgrd] 104.207.61.118 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.67.1.30
description:
[2025-02-05 11:30:56 +0100] info [webmaild] 187.67.1.30 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.130
description:
[2025-02-05 11:30:52 +0100] info [whostmgrd] 104.207.38.130 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.117.209.158
description:
Feb  5 11:31:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.117.209.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.115.157
description:
[2025-02-05 11:30:28 +0100] info [cpaneld] 156.228.115.157 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
description:
Feb  5 11:30:31 ait sshd[499568]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
description:
Feb  5 11:30:31 ait sshd[499568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.196
description:
[2025-02-05 11:30:32 +0100] info [cpaneld] 156.228.112.196 - abs2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.42.171
description:
[2025-02-05 11:30:35 +0100] info [whostmgrd] 104.207.42.171 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.182
description:
[2025-02-05 11:30:41 +0100] info [whostmgrd] 104.207.54.182 - abs1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.45
description:
[2025-02-05 11:30:27 +0100] info [whostmgrd] 104.207.57.45 - abs3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.77.143
description:
[2025-02-05 11:30:29 +0100] info [cpaneld] 156.228.77.143 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.40.229
description:
[2025-02-05 11:30:30 +0100] info [whostmgrd] 104.207.40.229 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.81
description:
[2025-02-05 11:30:40 +0100] info [whostmgrd] 154.214.1.81 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.234
description:
[2025-02-05 11:30:52 +0100] info [whostmgrd] 104.207.56.234 - abs4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.51.154
description:
[2025-02-05 11:30:54 +0100] info [whostmgrd] 104.207.51.154 - abs1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.255
description:
[2025-02-05 11:30:33 +0100] info [whostmgrd] 104.207.60.255 - abs2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.113.162
description:
[2025-02-05 11:30:38 +0100] info [cpaneld] 156.228.113.162 - abs1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.63
description:
[2025-02-05 11:30:39 +0100] info [whostmgrd] 156.228.85.63 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
description:
2025-02-05 11:30:37 dovecot_plain authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:39562: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.214.1.5
description:
[2025-02-05 11:31:01 +0100] info [whostmgrd] 154.214.1.5 - abs1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.111.2.124
description:
[2025-02-05 11:31:30 +0100] info [webmaild] 79.111.2.124 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
description:
Feb  5 11:31:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-02-05 11:32:16 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:44529: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.137
description:
47.128.122.137 - - [05/Feb/2025:11:32:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20913813 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106%2C205%2C30&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.137


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.51.59.147
description:
[2025-02-05 11:32:20 +0100] info [webmaild] 179.51.59.147 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
description:
2025-02-05 11:31:33 dovecot_plain authenticator failed for ([183.107.76.127]) [183.107.76.127]:56400: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Feb  5 11:32:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-02-05 11:32:02 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:33466: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
description:
Feb  5 11:32:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Feb  5 11:32:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-02-05 11:32:36 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:36120: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.149.106
description:
Feb  5 11:32:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.149.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.109.188.171
description:
[2025-02-05 11:32:51 +0100] info [webmaild] 176.109.188.171 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
description:
2025-02-05 11:32:51 dovecot_plain authenticator failed for ([124.114.149.106]) [124.114.149.106]:47636: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Feb  5 11:33:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-02-05 11:33:24 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:60226: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-02-05 11:33:49 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:50720: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-02-05 11:34:07 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:23572: 535 Incorrect authentication data (set_id=test@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
description:
2025-02-05 11:34:15 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:39902: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.55.88.65
description:
[2025-02-05 11:33:38 +0100] info [webmaild] 191.55.88.65 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Feb  5 11:34:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
description:
Feb  5 11:33:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
description:
2025-02-05 11:33:53 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:53149: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
description:
Feb  5 11:34:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Feb  5 11:33:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-02-05 11:33:42 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:62850: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Feb  5 11:33:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.186.221
description:
[2025-02-05 11:34:13 +0100] info [webmaild] 168.0.186.221 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.180.33
description:
Feb  5 11:35:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.180.33 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.244
description:
47.128.119.244 - - [05/Feb/2025:11:35:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17499860 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?duration=short&filter_course-category=205&filtering=1&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.244


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.94.170.198
description:
[2025-02-05 11:35:12 +0100] info [webmaild] 138.94.170.198 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
description:
2025-02-05 11:35:15 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:45461: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.22.68.213
description:
Feb  5 11:35:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.22.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.180.33
description:
2025-02-05 11:35:23 dovecot_plain authenticator failed for ([218.14.180.33]) [218.14.180.33]:36370: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Feb  5 11:35:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-02-05 11:35:10 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:47688: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  5 11:36:06 ait sshd[501999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Feb  5 11:36:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-02-05 11:36:25 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:56986: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
description:
Feb  5 11:35:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-02-05 11:35:31 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:52980: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  5 11:36:06 ait sshd[501999]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.120.196.192
description:
[2025-02-05 11:36:14 +0100] info [webmaild] 146.120.196.192 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.61.187.40
description:
[2025-02-05 11:35:41 +0100] info [webmaild] 189.61.187.40 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.110
description:
2025-02-05 11:36:46 dovecot_plain authenticator failed for (bulaunt) [65.20.251.110]:57243: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.195
description:
Feb  5 11:37:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.136.24
description:
Feb  5 11:37:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.136.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
description:
2025-02-05 11:36:39 dovecot_plain authenticator failed for (90.174.34.58.broad.xw.sh.dynamic.163data.com.cn) [58.34.174.90]:38368: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.110
description:
Feb  5 11:36:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  5 11:36:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-05 11:36:52 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:55739: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Feb  5 11:36:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.255.144.71
description:
[2025-02-05 11:36:51 +0100] info [webmaild] 138.255.144.71 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-02-05 11:36:53 dovecot_plain authenticator failed for 9498.telnet.bg (zesistous) [87.254.165.100]:37488: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-02-05 11:37:09 dovecot_plain authenticator failed for (5nyw9latkbwa3wf4eb) [77.40.62.195]:17892: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
description:
2025-02-05 11:37:12 dovecot_plain authenticator failed for ([218.206.136.24]) [218.206.136.24]:47260: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.174.90
description:
Feb  5 11:36:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.174.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
description:
Feb  5 11:37:27 ait sshd[502594]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  5 11:37:28 ait sshd[502594]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
description:
Feb  5 11:37:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
description:
2025-02-05 11:37:33 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:40878: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.129.98.22
description:
[2025-02-05 11:37:48 +0100] info [webmaild] 178.129.98.22 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.188.231
description:
[2025-02-05 11:38:19 +0100] info [webmaild] 177.54.188.231 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.200.36.39
description:
[2025-02-05 11:38:57 +0100] info [webmaild] 103.200.36.39 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.243.213.192
description:
[2025-02-05 11:39:29 +0100] info [webmaild] 193.243.213.192 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
description:
Feb  5 11:39:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 162.215.215.200
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:11-39.162.215.215.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-05 11:40:08 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:39202: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Feb  5 11:40:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.220.209.59
description:
2025-02-05 11:40:24 dovecot_plain authenticator failed for ([114.220.209.59]) [114.220.209.59]:47272: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.146.210.180
description:
Feb  5 11:40:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.146.210.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Feb  5 11:39:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-05 11:39:43 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:25541: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.211.97
description:
Feb  5 11:39:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.211.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.220.209.59
description:
Feb  5 11:40:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.220.209.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.218.133.106
description:
Feb  5 11:39:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.218.133.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.218.133.106
description:
2025-02-05 11:39:32 dovecot_plain authenticator failed for ([103.218.133.106]) [103.218.133.106]:53939: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 11:39:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Feb  5 11:39:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.211.97
description:
2025-02-05 11:39:55 dovecot_plain authenticator failed for (v3t45p91iwouti31cjbn) [136.169.211.97]:30569: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  5 11:40:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.167.59
description:
[2025-02-05 11:40:21 +0100] info [webmaild] 90.156.167.59 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-05 11:39:42 dovecot_plain authenticator failed for (oveliseic) [109.167.140.130]:50487: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-02-05 11:39:43 dovecot_plain authenticator failed for (conde) [64.72.74.162]:35010: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-02-05 11:39:44 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:56054: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-02-05 11:40:14 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:43250: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Feb  5 11:40:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
description:
2025-02-05 11:40:35 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:38061: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-05 11:41:13 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ciande) [87.103.126.54]:12282: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.212.183.97
description:
2025-02-05 11:41:23 dovecot_plain authenticator failed for ([182.212.183.97]) [182.212.183.97]:58453: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
description:
Feb  5 11:40:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.157.95.33
description:
[2025-02-05 11:40:53 +0100] info [webmaild] 103.157.95.33 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 11:41:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.212.183.97
description:
Feb  5 11:41:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.212.183.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-02-05 11:40:33 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:18692: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-02-05 11:40:51 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:34934: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.202.230.214
description:
Feb  5 11:40:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.202.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
description:
2025-02-05 11:40:59 dovecot_plain authenticator failed for host-91-202-230-214.static.oc3.zagan.visnet.pl [91.202.230.214]:50944: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 170.64.199.50
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:11-41.170.64.199.50||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.146.210.180
description:
2025-02-05 11:40:27 dovecot_plain authenticator failed for mail-02.03.perm.ru [46.146.210.180]:43657: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Feb  5 11:40:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
description:
Feb  5 11:41:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Feb  5 11:41:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
description:
2025-02-05 11:41:58 dovecot_plain authenticator failed for ([46.98.10.109]) [46.98.10.109]:56970: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.72.16
description:
[2025-02-05 11:42:09 +0100] info [webmaild] 177.131.72.16 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.230.142
description:
Feb  5 11:41:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.230.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.230.142
description:
2025-02-05 11:41:30 dovecot_plain authenticator failed for ([60.191.230.142]) [60.191.230.142]:49844: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
description:
2025-02-05 11:41:31 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:40659: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.210.250
description:
2025-02-05 11:41:44 dovecot_plain authenticator failed for ([187.12.210.250]) [187.12.210.250]:51968: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Feb  5 11:41:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.98.10.109
description:
Feb  5 11:41:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.98.10.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.253.18.179
description:
[2025-02-05 11:41:35 +0100] info [webmaild] 103.253.18.179 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.210.250
description:
Feb  5 11:41:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.210.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-02-05 11:41:47 dovecot_plain authenticator failed for ([221.149.203.183]) [221.149.203.183]:39098: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-02-05 11:41:48 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:46048: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.190.248.245
description:
[2025-02-05 11:42:55 +0100] info [webmaild] 179.190.248.245 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-02-05 11:43:15 dovecot_login authenticator failed for ([128.185.12.179]) [128.185.12.179]:47672: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.14.243.162
description:
[2025-02-05 11:43:28 +0100] info [webmaild] 190.14.243.162 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.33.44.12
description:
2025-02-05 11:43:33 dovecot_login authenticator failed for ([209.33.44.12]) [209.33.44.12]:43900: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
description:
2025-02-05 11:43:38 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:51426: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-02-05 11:43:51 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:58720: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-44.80.76.51.123


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.31.194.203
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:11-44.194.31.194.203


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.157.255
description:
[2025-02-05 11:44:24 +0100] info [webmaild] 177.55.157.255 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
description:
2025-02-05 11:44:46 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:60482: 535 Incorrect authentication data (set_id=mappiah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 37.221.194.228
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:11-44.37.221.194.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.84.180.225
description:
[2025-02-05 11:44:59 +0100] info [webmaild] 189.84.180.225 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.133
description:
2025-02-05 11:45:25 dovecot_plain authenticator failed for (lemonis) [65.20.193.133]:41659: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-02-05 11:44:29 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:50709: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-02-05 11:45:20 dovecot_plain authenticator failed for (milled) [109.160.123.6]:44476: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.252.204
description:
[2025-02-05 11:45:27 +0100] info [webmaild] 131.72.252.204 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-02-05 11:45:27 dovecot_plain authenticator failed for (dowely) [102.53.15.18]:36047: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.95.32.254
description:
[2025-02-05 11:45:58 +0100] info [webmaild] 177.95.32.254 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.230.179
description:
2025-02-05 11:45:58 dovecot_plain authenticator failed for 189.115.230.179.dynamic.adsl.gvt.net.br [189.115.230.179]:41767: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-05 11:46:08 dovecot_plain authenticator failed for ([103.65.227.72]) [114.130.181.74]:38653: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.83
description:
2025-02-05 11:46:18 dovecot_plain authenticator failed for 083.42.246.220.static.netvigator.com [220.246.42.83]:58039: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
description:
2025-02-05 11:47:08 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:46272: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.158
description:
Feb  5 11:46:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
description:
2025-02-05 11:46:33 dovecot_plain authenticator failed for 111-70-29-158.emome-ip.hinet.net [111.70.29.158]:41247: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
description:
2025-02-05 11:46:48 dovecot_plain authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:57007: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.206.233.173
description:
[2025-02-05 11:47:04 +0100] info [webmaild] 5.206.233.173 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-02-05 11:48:20 dovecot_plain authenticator failed for (scaly) [102.53.15.56]:48441: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.240.145.146
description:
[2025-02-05 11:47:33 +0100] info [webmaild] 88.240.145.146 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.109.117
description:
[2025-02-05 11:48:06 +0100] info [webmaild] 143.202.109.117 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 11:48:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-05 11:48:14 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (pente) [87.103.126.54]:49056: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 11:48:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
description:
2025-02-05 11:48:42 dovecot_login authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:40524: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-02-05 11:49:04 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:34195: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.204.112.147
description:
2025-02-05 11:49:24 dovecot_login authenticator failed for ([163.204.112.147]) [163.204.112.147]:37720: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-02-05 11:49:23 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:50766: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-05 11:48:28 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (whearyterd) [87.103.126.54]:22942: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.35.28.199
description:
[2025-02-05 11:48:36 +0100] info [webmaild] 179.35.28.199 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.123.92.130
description:
Feb  5 11:49:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.123.92.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
description:
2025-02-05 11:49:09 dovecot_login authenticator failed for ([50.123.92.130]) [50.123.92.130]:58514: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.39.109.18
description:
[2025-02-05 11:50:16 +0100] info [webmaild] 189.39.109.18 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-02-05 11:50:26 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:52034: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.63.70
description:
2025-02-05 11:49:36 dovecot_login authenticator failed for ([59.12.63.70]) [59.12.63.70]:46998: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.148.216.41
description:
[2025-02-05 11:49:40 +0100] info [webmaild] 37.148.216.41 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 11:50:45 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:38769: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 197.159.0.211
description:
Feb  5 11:50:59 ait sshd[509183]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.159.0.211


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.46.8
description:
[2025-02-05 11:51:00 +0100] info [webmaild] 37.236.46.8 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.21.209
description:
Feb  5 11:51:59 ait sshd[509501]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.21.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.20.98.138
description:
[2025-02-05 11:52:14 +0100] info [webmaild] 94.20.98.138 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-02-05 11:52:21 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:56235: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.239.73.157
description:
[2025-02-05 11:51:30 +0100] info [webmaild] 45.239.73.157 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.21.209
description:
Feb  5 11:51:59 ait sshd[509501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.21.209  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 11:52:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
description:
Feb  5 11:52:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
description:
2025-02-05 11:51:58 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:50406: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.86.2.18
description:
Feb  5 11:52:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.86.2.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Feb  5 11:53:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-02-05 11:53:12 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:3779: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.194.189.120
description:
[2025-02-05 11:52:49 +0100] info [webmaild] 168.194.189.120 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
description:
2025-02-05 11:52:29 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:51383: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.69.242.122
description:
2025-02-05 11:52:35 dovecot_plain authenticator failed for ([101.69.242.122]) [101.69.242.122]:37052: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-02-05 11:52:50 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:58304: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.146.7
description:
Feb  5 11:52:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.146.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.86.2.18
description:
2025-02-05 11:52:58 dovecot_plain authenticator failed for (host103-86-2-18.airwir.com) [103.86.2.18]:54871: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
description:
2025-02-05 11:52:28 dovecot_plain authenticator failed for ([124.136.29.20]) [124.136.29.20]:32007: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Feb  5 11:54:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
description:
2025-02-05 11:54:27 dovecot_plain authenticator failed for (pool.sevtele.com) [178.159.117.51]:33858: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-02-05 11:54:22 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:60465: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.69.17.18
description:
[2025-02-05 11:54:07 +0100] info [webmaild] 105.69.17.18 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.45.245.35
description:
Feb  5 11:54:11 ait sshd[510398]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.45.245.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-02-05 11:54:08 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:52326: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
description:
Feb  5 11:54:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.246.89.2
description:
[2025-02-05 11:53:36 +0100] info [webmaild] 194.246.89.2 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.159.239.202
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-53.103.159.239.202


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.45.245.35
description:
Feb  5 11:54:11 ait sshd[510398]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.45.245.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
description:
Feb  5 11:54:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Feb  5 11:55:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Feb  5 11:55:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-02-05 11:54:36 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:56500: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
description:
Feb  5 11:54:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Feb  5 11:54:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.73.121.209
description:
Feb  5 11:54:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.73.121.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 11:54:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.73.121.209
description:
2025-02-05 11:54:55 dovecot_plain authenticator failed for (equing) [62.73.121.209]:55561: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.186.111.248
description:
[2025-02-05 11:55:05 +0100] info [webmaild] 138.186.111.248 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-02-05 11:55:17 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:37696: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
description:
2025-02-05 11:55:49 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:59562: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-02-05 11:55:40 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:40727: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.71.134
description:
Feb  5 11:55:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.71.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.93.69
description:
Feb  5 11:55:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.93.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
description:
Feb  5 11:55:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-02-05 11:55:30 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:59997: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
description:
2025-02-05 11:55:31 dovecot_plain authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:52131: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Feb  5 11:55:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Feb  5 11:55:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.225.231.80
description:
[2025-02-05 11:55:30 +0100] info [webmaild] 186.225.231.80 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.93.69
description:
2025-02-05 11:55:37 dovecot_plain authenticator failed for ([210.99.93.69]) [210.99.93.69]:58804: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
description:
Feb  5 11:55:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.109.138
description:
2025-02-05 11:55:30 dovecot_plain authenticator failed for ([222.190.109.138]) [222.190.109.138]:34997: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
description:
2025-02-05 11:55:46 dovecot_plain authenticator failed for ([201.18.75.41]) [201.18.71.134]:59813: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.239.6
description:
[2025-02-05 11:56:12 +0100] info [webmaild] 179.60.239.6 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.109.138
description:
Feb  5 11:55:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.109.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Feb  5 11:56:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:UG24J1150055||WPU:UG24J1150055||RSV:6.65||T:APACHE||MV:11-57.170.205.31.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.15.36.1
description:
[2025-02-05 11:56:44 +0100] info [webmaild] 157.15.36.1 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 11:57:10 ait sshd[511800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Feb  5 11:56:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  5 11:57:10 ait sshd[511800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 11:57:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.47
description:
Feb  5 11:58:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.107.61.148
description:
[2025-02-05 11:57:50 +0100] info [webmaild] 41.107.61.148 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Feb  5 11:58:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-02-05 11:58:14 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:11420: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Feb  5 11:58:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.47
description:
2025-02-05 11:58:25 dovecot_plain authenticator failed for 111-70-32-47.emome-ip.hinet.net [111.70.32.47]:53404: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 11:58:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 11:57:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 144.48.151.222
description:
[2025-02-05 11:58:29 +0100] info [webmaild] 144.48.151.222 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.130.184
description:
Feb  5 11:58:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.130.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Feb  5 11:58:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.130
description:
Feb  5 11:58:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Feb  5 11:58:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.130.184
description:
2025-02-05 11:58:45 dovecot_plain authenticator failed for ([120.196.130.184]) [120.196.130.184]:59311: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-58.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.0.3.116
description:
[2025-02-05 11:59:16 +0100] info [webmaild] 102.0.3.116 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Feb  5 11:59:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-02-05 11:59:23 dovecot_plain authenticator failed for (drideran) [185.113.51.55]:42305: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.130
description:
2025-02-05 11:58:30 dovecot_plain authenticator failed for ([123.212.0.130]) [123.212.0.130]:40588: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.83.2
description:
[2025-02-05 11:58:45 +0100] info [webmaild] 177.39.83.2 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
description:
Feb  5 11:59:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
description:
2025-02-05 11:59:20 dovecot_plain authenticator failed for (sphed) [63.116.23.24]:53770: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
description:
Feb  5 11:59:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.102.90
description:
Feb  5 12:00:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.102.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
description:
2025-02-05 12:00:06 dovecot_plain authenticator failed for ([117.32.102.90]) [117.32.102.90]:60952: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.251.57
description:
[2025-02-05 12:00:24 +0100] info [webmaild] 170.238.251.57 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.8.106
description:
Feb  5 11:59:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
description:
Feb  5 11:59:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.2
description:
2025-02-05 11:59:54 dovecot_plain authenticator failed for ([58.122.255.2]) [58.122.255.2]:57482: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.215.147
description:
Feb  5 12:00:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.215.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-05 12:00:13 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:45082: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Feb  5 12:00:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Feb  5 11:59:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-02-05 11:59:50 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:37982: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.2
description:
Feb  5 11:59:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
description:
2025-02-05 11:59:56 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:44003: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  5 12:00:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.8.106
description:
2025-02-05 11:59:49 dovecot_plain authenticator failed for ([58.16.8.106]) [58.16.8.106]:52087: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
description:
2025-02-05 11:59:55 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:55457: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.157.246.26
description:
2025-02-05 12:00:04 dovecot_plain authenticator failed for ([117.157.246.26]) [117.157.246.26]:52838: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.215.147
description:
2025-02-05 12:00:05 dovecot_plain authenticator failed for ([183.98.215.147]) [183.98.215.147]:7973: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-02-05 12:00:19 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:50532: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
description:
2025-02-05 12:00:57 dovecot_plain authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:60418: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Feb  5 12:01:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  5 12:00:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
description:
2025-02-05 12:01:03 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:52985: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.161.98.179
description:
Feb  5 12:01:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.161.98.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.148.173.150
description:
Feb  5 12:01:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.148.173.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
description:
2025-02-05 12:00:40 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:57524: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
description:
2025-02-05 12:00:55 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:53476: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.58.203
description:
2025-02-05 12:00:57 dovecot_plain authenticator failed for ([60.191.58.203]) [60.191.58.203]:50648: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
description:
2025-02-05 12:00:59 dovecot_plain authenticator failed for (189-113-43-174.netturbo.com.br) [189.113.43.174]:45292: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
description:
2025-02-05 12:01:04 dovecot_plain authenticator failed for ([111.39.167.59]) [111.39.167.59]:53183: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
description:
Feb  5 12:00:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Feb  5 12:00:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Feb  5 12:00:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-02-05 12:00:41 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:47364: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.245.67
description:
Feb  5 12:00:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.245.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-02-05 12:00:49 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:50917: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Feb  5 12:00:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Feb  5 12:00:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Feb  5 12:01:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
description:
2025-02-05 12:01:17 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:41256: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
description:
Feb  5 12:01:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-02-05 12:00:37 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:54882: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
description:
2025-02-05 12:00:39 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:36258: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.58.203
description:
Feb  5 12:00:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.58.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-05 12:00:55 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:50094: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
description:
Feb  5 12:00:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-02-05 12:00:40 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:17182: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-02-05 12:00:42 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:55344: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:UG24J1150055||WPU:UG24J1150055||RSV:6.65||T:APACHE||MV:12-00.170.205.31.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Feb  5 12:00:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.151
description:
Feb  5 12:00:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-02-05 12:00:49 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:39698: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
description:
Feb  5 12:00:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.55.59
description:
Feb  5 12:00:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.55.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.144.48.56
description:
Feb  5 12:00:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.144.48.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.178.175
description:
2025-02-05 12:00:42 dovecot_plain authenticator failed for 94-255-178-175.cust.bredband2.com [94.255.178.175]:57998: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
description:
Feb  5 12:00:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Feb  5 12:00:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-02-05 12:00:45 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:63925: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Feb  5 12:00:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
description:
2025-02-05 12:00:53 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:50214: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Feb  5 12:00:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
description:
2025-02-05 12:00:58 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:36164: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
description:
2025-02-05 12:01:14 dovecot_plain authenticator failed for ([189.108.24.17]) [200.148.173.150]:55495: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Feb  5 12:00:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-02-05 12:00:46 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:52835: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.154.196
description:
2025-02-05 12:01:06 dovecot_plain authenticator failed for p50979ac4.dip0.t-ipconnect.de [80.151.154.196]:53846: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
description:
2025-02-05 12:00:50 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:59854: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-02-05 12:00:57 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:1393: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-02-05 12:00:56 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:42738: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
description:
2025-02-05 12:01:08 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:59781: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.157.142
description:
Feb  5 12:01:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.157.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-05 12:00:45 dovecot_plain authenticator failed for ([80.241.253.238]) [2.57.219.2]:39410: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
description:
2025-02-05 12:00:42 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:51908: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-02-05 12:00:52 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:47763: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.144.48.56
description:
2025-02-05 12:01:00 dovecot_plain authenticator failed for ([103.144.48.56]) [103.144.48.56]:50556: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Feb  5 12:00:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
description:
2025-02-05 12:00:41 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:54376: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-02-05 12:00:58 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:41672: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-02-05 12:01:02 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:59890: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.151.154.196
description:
Feb  5 12:01:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.151.154.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-02-05 12:01:08 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:59232: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-02-05 12:00:39 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:42954: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-02-05 12:00:39 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:44782: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-05 12:00:52 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:53396: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
description:
2025-02-05 12:00:57 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:54445: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
description:
Feb  5 12:01:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.5.76.239
description:
Feb  5 12:01:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.5.76.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-02-05 12:00:39 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:58990: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  5 12:01:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.166.85.53
description:
Feb  5 12:00:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.166.85.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.157.142
description:
2025-02-05 12:01:24 dovecot_plain authenticator failed for ([61.80.157.142]) [61.80.157.142]:49398: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-02-05 12:00:52 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:39294: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.245.67
description:
2025-02-05 12:00:44 dovecot_plain authenticator failed for ([120.238.245.67]) [120.238.245.67]:56132: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Feb  5 12:00:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.235.203.63
description:
Feb  5 12:00:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.235.203.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Feb  5 12:00:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
description:
2025-02-05 12:01:04 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:57724: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-02-05 12:01:18 dovecot_plain authenticator failed for ([121.202.154.250]) [121.202.154.250]:8575: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Feb  5 12:00:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
description:
Feb  5 12:00:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.167.59
description:
Feb  5 12:01:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.167.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Feb  5 12:00:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Feb  5 12:01:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-02-05 12:00:37 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:59308: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Feb  5 12:00:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
description:
Feb  5 12:00:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Feb  5 12:00:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
description:
Feb  5 12:00:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Feb  5 12:00:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-02-05 12:00:54 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:39588: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Feb  5 12:01:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Feb  5 12:00:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
description:
Feb  5 12:00:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
description:
2025-02-05 12:00:59 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:50076: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
description:
2025-02-05 12:01:16 dovecot_plain authenticator failed for ([77.235.25.35]) [77.235.25.35]:58741: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-02-05 12:01:16 dovecot_plain authenticator failed for ([60.247.92.186]) [60.247.92.186]:56824: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-02-05 12:00:50 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:52459: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-02-05 12:00:41 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:46627: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Feb  5 12:00:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Feb  5 12:00:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  5 12:00:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.113.43.174
description:
Feb  5 12:00:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.113.43.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-02-05 12:01:05 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:2117: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.161.98.179
description:
2025-02-05 12:01:12 dovecot_plain authenticator failed for ([119.161.97.235]) [119.161.98.179]:45864: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.255.178.175
description:
Feb  5 12:00:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.255.178.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Feb  5 12:01:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-02-05 12:01:09 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:60418: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
description:
2025-02-05 12:00:49 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:57474: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.55.59
description:
2025-02-05 12:00:57 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:47890: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
description:
Feb  5 12:00:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Feb  5 12:00:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-02-05 12:00:44 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:54854: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.126.214
description:
2025-02-05 12:00:44 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:49850: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
description:
Feb  5 12:01:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.5.76.239
description:
2025-02-05 12:01:13 dovecot_plain authenticator failed for ([112.5.76.239]) [112.5.76.239]:43759: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
description:
Feb  5 12:01:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
description:
Feb  5 12:01:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-02-05 12:00:42 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:33800: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
description:
2025-02-05 12:00:42 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:50278: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-02-05 12:00:59 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:56956: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Feb  5 12:01:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
description:
2025-02-05 12:01:14 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:50684: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Feb  5 12:00:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Feb  5 12:00:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-02-05 12:00:40 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:42876: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.126.214
description:
Feb  5 12:00:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.126.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Feb  5 12:00:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
description:
Feb  5 12:01:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Feb  5 12:00:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Feb  5 12:00:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-02-05 12:00:38 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:60708: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-02-05 12:00:38 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:34364: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
description:
Feb  5 12:00:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-02-05 12:00:42 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:47517: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-02-05 12:00:47 dovecot_plain authenticator failed for ([125.139.124.120]) [125.139.124.120]:36506: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-02-05 12:00:53 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:50689: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Feb  5 12:00:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
description:
2025-02-05 12:01:27 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:46014: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
description:
Feb  5 12:00:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
description:
Feb  5 12:00:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Feb  5 12:01:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Feb  5 12:00:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.166.85.53
description:
2025-02-05 12:00:59 dovecot_plain authenticator failed for ([121.166.85.53]) [121.166.85.53]:55542: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.17.145
description:
[2025-02-05 12:01:00 +0100] info [webmaild] 168.196.17.145 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-05 12:01:08 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:58276: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
description:
Feb  5 12:00:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
description:
2025-02-05 12:00:57 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:23962: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Feb  5 12:00:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-02-05 12:01:51 dovecot_plain authenticator failed for (arduck) [185.168.173.87]:60274: 535 Incorrect authentication data (set_id=mordzifa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Feb  5 12:02:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.58.250
description:
[2025-02-05 12:01:34 +0100] info [webmaild] 179.0.58.250 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Feb  5 12:01:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.68.3
description:
[2025-02-05 12:02:06 +0100] info [webmaild] 179.127.68.3 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-02-05 12:02:06 dovecot_plain authenticator failed for (galloste) [64.72.74.162]:41851: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.37.35.155
description:
Feb  5 12:02:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.37.35.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-02-05 12:02:27 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:58300: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.69.31.50
description:
Feb  5 12:02:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.69.31.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Feb  5 12:02:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-05 12:02:49 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:49587: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 12:03:07 ait sshd[514859]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.63.15.18
description:
[2025-02-05 12:03:11 +0100] info [webmaild] 177.63.15.18 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.31.50
description:
2025-02-05 12:02:55 dovecot_plain authenticator failed for ([109.69.31.50]) [109.69.31.50]:55042: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Feb  5 12:02:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Feb  5 12:02:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.37.35.155
description:
2025-02-05 12:02:28 dovecot_plain authenticator failed for c-68-37-35-155.hsd1.mi.comcast.net [68.37.35.155]:45270: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.123
description:
2025-02-05 12:03:10 dovecot_plain authenticator failed for 123.149.48.116.static.netvigator.com [116.48.149.123]:60274: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Feb  5 12:02:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-02-05 12:02:48 dovecot_plain authenticator failed for ([60.247.92.186]) [60.247.92.186]:33214: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
description:
2025-02-05 12:02:59 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:49710: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 12:03:07 ait sshd[514859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.52.89.218
description:
2025-02-05 12:03:19 dovecot_plain authenticator failed for ([84.52.89.218]) [84.52.89.218]:51581: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-02-05 12:02:33 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:49378: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.167.253.195
description:
Feb  5 12:02:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.167.253.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  5 12:02:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
description:
Feb  5 12:02:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.123
description:
Feb  5 12:03:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-02-05 12:03:22 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:39496: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.52.89.218
description:
Feb  5 12:03:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.52.89.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Feb  5 12:03:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
description:
Feb  5 12:03:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  5 12:03:37 ait sshd[515040]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 12:03:37 ait sshd[515040]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 170.64.199.50
domain: afaccra.u3l.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/style.php||SC:/home/titlemas/public_html/afaccra.u3l.us/wp-content/uploads/style.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.193.83
description:
2025-02-05 12:03:54 dovecot_plain authenticator failed for (mobile-166-195-193-083.mycingular.net) [166.195.193.83]:44176: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.164.180
description:
[2025-02-05 12:03:59 +0100] info [webmaild] 177.131.164.180 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-02-05 12:04:09 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:36805: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.1.153.244
description:
[2025-02-05 12:04:15 +0100] info [webmaild] 169.1.153.244 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.223.154.170
description:
2025-02-05 12:03:38 dovecot_plain authenticator failed for ([102.223.154.170]) [102.223.154.170]:59540: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-02-05 12:03:43 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:36125: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.193.83
description:
Feb  5 12:03:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.193.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-02-05 12:03:47 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:55919: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 170.64.199.50
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:12-03.170.64.199.50||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Feb  5 12:04:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Feb  5 12:03:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Feb  5 12:03:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-02-05 12:04:33 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:33656: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.144.1.93
description:
[2025-02-05 12:04:46 +0100] info [webmaild] 41.144.1.93 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 12:05:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Feb  5 12:04:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 12:04:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.244
description:
Feb  5 12:05:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.244 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.128.165.171
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-05.118.128.165.171


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.113.9.34
description:
Feb  5 12:05:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.113.9.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.209.10.219
description:
[2025-02-05 12:05:49 +0100] info [webmaild] 62.209.10.219 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.7.249.43
description:
[2025-02-05 12:06:25 +0100] info [webmaild] 103.7.249.43 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.244
description:
2025-02-05 12:05:38 dovecot_plain authenticator failed for ([123.214.65.244]) [123.214.65.244]:49740: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.113.9.34
description:
2025-02-05 12:05:50 dovecot_plain authenticator failed for ([111.113.9.34]) [111.113.9.34]:47828: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  5 12:07:11 ait sshd[516672]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Feb  5 12:06:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.45.79
description:
[2025-02-05 12:07:17 +0100] info [webmaild] 179.189.45.79 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-02-05 12:06:43 dovecot_login authenticator failed for ([221.161.16.240]) [221.161.16.240]:55098: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
description:
2025-02-05 12:06:53 dovecot_login authenticator failed for ([103.115.31.219]) [103.115.31.219]:50360: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Feb  5 12:07:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-02-05 12:07:23 dovecot_plain authenticator failed for (sured) [102.53.15.18]:46077: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.31.219
description:
Feb  5 12:06:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.31.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  5 12:07:11 ait sshd[516672]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24  user=root


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.99.34.216
domain: tracker.aitedu.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:12-07.139.99.34.216||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.109.138
description:
2025-02-05 12:07:53 dovecot_plain authenticator failed for ([222.190.109.138]) [222.190.109.138]:34213: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Feb  5 12:07:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-02-05 12:07:58 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:32738: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.6.38
description:
Feb  5 12:08:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  5 12:08:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-05 12:08:11 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:56739: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-02-05 12:08:24 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:34310: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Feb  5 12:07:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.102.141.123
description:
Feb  5 12:07:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.102.141.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 12:07:52 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:42685: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-02-05 12:07:55 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:61631: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
description:
Feb  5 12:08:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 12:08:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-02-05 12:08:07 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:18565: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.102.141.123
description:
2025-02-05 12:07:55 dovecot_plain authenticator failed for ([75.102.141.123]) [75.102.141.123]:40491: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.6.38
description:
2025-02-05 12:08:07 dovecot_plain authenticator failed for 111-70-6-38.emome-ip.hinet.net [111.70.6.38]:56764: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-02-05 12:08:14 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:30618: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  5 12:08:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
description:
Feb  5 12:08:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.31
description:
2025-02-05 12:08:00 dovecot_plain authenticator failed for (m121-202-200-31.smartone.com) [121.202.200.31]:44640: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Feb  5 12:08:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-02-05 12:08:05 dovecot_plain authenticator failed for (croidal) [185.65.238.250]:55288: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 12:08:08 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:53928: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Feb  5 12:08:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Feb  5 12:08:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Feb  5 12:07:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.109.138
description:
Feb  5 12:07:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.109.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-05 12:07:51 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:23252: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
description:
2025-02-05 12:08:01 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:50044: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-02-05 12:08:07 dovecot_plain authenticator failed for ([179.181.133.153]) [179.181.133.153]:51898: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-05 12:08:20 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:11086: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Feb  5 12:07:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Feb  5 12:08:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-02-05 12:08:23 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:41008: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.91.175.78
description:
[2025-02-05 12:07:45 +0100] info [webmaild] 77.91.175.78 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  5 12:07:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
description:
2025-02-05 12:08:02 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:33182: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-05 12:08:12 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:38063: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-02-05 12:08:13 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:43592: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-02-05 12:07:50 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:38052: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-02-05 12:07:52 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:48794: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.53.187
description:
Feb  5 12:07:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.53.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  5 12:08:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.59.211.214
description:
2025-02-05 12:08:09 dovecot_plain authenticator failed for ([201.59.211.214]) [201.59.211.214]:60283: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.206.91.51
description:
Feb  5 12:08:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.206.91.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Feb  5 12:07:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-02-05 12:07:57 dovecot_plain authenticator failed for ([195.222.57.182]) [195.222.57.190]:34432: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Feb  5 12:08:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.59.211.214
description:
Feb  5 12:08:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.59.211.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
description:
Feb  5 12:08:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-02-05 12:08:07 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:36348: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Feb  5 12:08:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
description:
2025-02-05 12:08:24 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:45732: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
description:
2025-02-05 12:08:25 dovecot_plain authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:42444: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Feb  5 12:07:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.31
description:
Feb  5 12:07:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Feb  5 12:08:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
description:
2025-02-05 12:08:10 dovecot_plain authenticator failed for ([146.120.208.148]) [146.120.208.148]:47941: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Feb  5 12:08:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.206.105.37
description:
2025-02-05 12:09:09 dovecot_plain authenticator failed for ([10.13.105.93]) [195.206.105.37]:63330: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.0.247.46
description:
[2025-02-05 12:09:10 +0100] info [webmaild] 138.0.247.46 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.34.190
description:
[2025-02-05 12:08:33 +0100] info [webmaild] 45.5.34.190 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 12:08:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 12:08:48 ait sshd[517468]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 12:08:48 ait sshd[517468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.206.105.37
description:
Feb  5 12:09:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.206.105.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
description:
2025-02-05 12:10:11 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:43074: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.65.94.98
description:
[2025-02-05 12:10:16 +0100] info [webmaild] 186.65.94.98 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-02-05 12:09:32 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:16363: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
description:
Feb  5 12:09:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
description:
Feb  5 12:09:59 ait sshd[517966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
description:
2025-02-05 12:10:01 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:36148: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Feb  5 12:10:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Feb  5 12:09:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.222.80.77
description:
Feb  5 12:09:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.222.80.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
description:
Feb  5 12:10:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 12:09:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  5 12:09:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-05 12:10:00 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:40190: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.212.235.151
description:
Feb  5 12:09:59 ait sshd[517966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.212.235.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.61.170.93
description:
[2025-02-05 12:11:14 +0100] info [webmaild] 167.61.170.93 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Feb  5 12:10:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.22.95.144
description:
[2025-02-05 12:10:47 +0100] info [webmaild] 187.22.95.144 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 122.224.68.164
description:
2025-02-05 12:11:05 H=(mail.bsoft.cloud) [122.224.68.164]:51120 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<zixux@bsoft.cloud> rejected RCPT <1pvJDf-0007Ln-1b@ait.aitvarsity.net>: Unrouteable address


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Feb  5 12:11:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.189.103.161
description:
[2025-02-05 12:11:48 +0100] info [webmaild] 181.189.103.161 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
description:
2025-02-05 12:12:07 dovecot_login authenticator failed for (95x79x57x221.static-business.nn.ertelecom.ru) [95.79.57.221]:52380: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-02-05 12:12:22 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:58320: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: elibrary.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:UG24J1150055||WPU:UG24J1150055||RSV:6.65||T:APACHE||MV:12-11.170.205.31.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Feb  5 12:11:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-02-05 12:11:33 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:47910: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Feb  5 12:11:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.140.142.40
description:
Feb  5 12:11:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.140.142.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  5 12:11:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.121.200
description:
47.128.121.200 - - [05/Feb/2025:12:11:37 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11418985 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/9981a1?panel=security" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.121.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Feb  5 12:11:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Feb  5 12:12:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Feb  5 12:12:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
description:
Feb  5 12:12:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-05 12:11:34 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:52295: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-02-05 12:11:45 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:37320: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-02-05 12:11:47 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:53300: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.142.40
description:
2025-02-05 12:11:58 dovecot_login authenticator failed for ([103.106.192.161]) [103.140.142.40]:55706: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
description:
Feb  5 12:12:28 ait sshd[519290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.141.228.9
description:
Feb  5 12:12:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.141.228.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.210.10
description:
Feb  5 12:13:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.210.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.111.117
description:
[2025-02-05 12:13:22 +0100] info [webmaild] 143.255.111.117 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-02-05 12:13:25 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:59581: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.3.87
description:
Feb  5 12:12:28 ait sshd[519290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.113.3.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.221.48
description:
Feb  5 12:12:33 ait sshd[519322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.221.48  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  5 12:12:39 ait sshd[519344]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 12:12:39 ait sshd[519344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
description:
Feb  5 12:12:57 ait sshd[519437]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
description:
Feb  5 12:12:57 ait sshd[519437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.210.10
description:
2025-02-05 12:13:11 dovecot_plain authenticator failed for ([27.45.210.10]) [27.45.210.10]:39304: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
description:
Feb  5 12:12:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
description:
2025-02-05 12:12:55 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:49474: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Feb  5 12:13:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.141.228.9
description:
2025-02-05 12:12:32 dovecot_plain authenticator failed for ([95.141.228.9]) [95.141.228.9]:55350: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.221.48
description:
Feb  5 12:12:33 ait sshd[519322]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.221.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.124.96.190
description:
[2025-02-05 12:12:52 +0100] info [webmaild] 103.124.96.190 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.144
description:
Feb  5 12:13:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
description:
Feb  5 12:13:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-13.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.178.21.162
description:
Feb  5 12:13:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.178.21.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.199.20
description:
Feb  5 12:13:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.199.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
description:
2025-02-05 12:13:35 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:49844: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.192.67.233
description:
[2025-02-05 12:13:55 +0100] info [webmaild] 181.192.67.233 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.4.42.19
description:
Feb  5 12:14:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.4.42.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.199.20
description:
2025-02-05 12:13:30 dovecot_plain authenticator failed for ([157.122.199.20]) [157.122.199.20]:55377: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
description:
2025-02-05 12:13:41 dovecot_plain authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:49099: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-02-05 12:14:33 dovecot_login authenticator failed for ([180.188.139.189]) [180.188.139.189]:47149: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-02-05 12:14:46 dovecot_login authenticator failed for ([66.11.25.195]) [66.11.25.195]:54304: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
description:
2025-02-05 12:15:15 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:54230: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Feb  5 12:15:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.255.59
description:
Feb  5 12:14:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.210.255.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.210.255.59
description:
2025-02-05 12:14:28 dovecot_plain authenticator failed for ([192.210.255.59]) [192.210.255.59]:60821: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Feb  5 12:14:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.191.223.176
description:
[2025-02-05 12:14:30 +0100] info [webmaild] 179.191.223.176 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Feb  5 12:14:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
description:
Feb  5 12:15:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-02-05 12:15:25 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:35376: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.199.129
description:
Feb  5 12:15:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.199.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.199.129
description:
2025-02-05 12:15:40 dovecot_plain authenticator failed for (arble) [89.23.199.129]:40106: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  5 12:15:43 ait sshd[520569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.167.1.194
description:
[2025-02-05 12:15:44 +0100] info [webmaild] 78.167.1.194 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 12:16:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.227.84.75
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-16.165.227.84.75


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Feb  5 12:15:43 ait sshd[520569]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.95.68.54
description:
[2025-02-05 12:16:15 +0100] info [webmaild] 84.95.68.54 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
description:
Feb  5 12:17:21 ait sshd[521197]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.152.102.243
description:
[2025-02-05 12:16:34 +0100] info [webmaild] 178.152.102.243 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
description:
Feb  5 12:16:37 ait sshd[520922]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
description:
Feb  5 12:16:37 ait sshd[520922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67  user=bin


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.232.220.229
description:
[2025-02-05 12:17:09 +0100] info [webmaild] 186.232.220.229 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
description:
Feb  5 12:17:21 ait sshd[521197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-05 12:17:56 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:50999: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Feb  5 12:18:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-02-05 12:18:07 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:35978: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
description:
Feb  5 12:17:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
description:
2025-02-05 12:17:38 dovecot_login authenticator failed for ([58.18.42.74]) [58.18.42.74]:60978: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Feb  5 12:17:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.9.94
description:
[2025-02-05 12:19:48 +0100] info [webmaild] 45.166.9.94 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.14.155
description:
2025-02-05 12:20:01 dovecot_plain authenticator failed for ([183.237.14.155]) [183.237.14.155]:35870: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-02-05 12:20:19 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:45266: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.31.110
description:
47.128.31.110 - - [05/Feb/2025:12:19:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21609826 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/12/?duration=short%2Cmedium%2CextraLong&filtering=1&instructor=2&level=intermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.31.110


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.126.135.188
description:
2025-02-05 12:20:21 dovecot_plain authenticator failed for (user-static-164-126-135-188.mobile.play-internet.pl) [164.126.135.188]:47972: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
description:
2025-02-05 12:20:09 dovecot_plain authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:42190: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.14.155
description:
Feb  5 12:19:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.14.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.247
description:
Feb  5 12:20:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Feb  5 12:20:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 12:20:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.70.93.144
description:
[2025-02-05 12:21:09 +0100] info [webmaild] 177.70.93.144 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.213
description:
Feb  5 12:21:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
description:
Feb  5 12:21:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
description:
Feb  5 12:21:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.247
description:
Feb  5 12:20:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
description:
2025-02-05 12:21:10 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:58577: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
description:
2025-02-05 12:20:40 dovecot_plain authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:45246: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
description:
2025-02-05 12:21:02 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:60468: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
description:
2025-02-05 12:20:37 dovecot_plain authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:43208: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
description:
Feb  5 12:20:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.141.116.221
description:
[2025-02-05 12:21:38 +0100] info [webmaild] 41.141.116.221 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Feb  5 12:22:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-02-05 12:22:19 dovecot_plain authenticator failed for (untiona) [102.53.15.18]:44846: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.60.80
description:
Feb  5 12:21:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.60.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.69.246.96
description:
[2025-02-05 12:21:58 +0100] info [webmaild] 77.69.246.96 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Feb  5 12:22:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-02-05 12:22:22 dovecot_login authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:37021: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 12:22:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 12:23:21 ait sshd[524171]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 12:23:21 ait sshd[524171]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.24.156
description:
[2025-02-05 12:22:34 +0100] info [webmaild] 102.219.24.156 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Feb  5 12:22:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-02-05 12:22:38 dovecot_login authenticator failed for ([123.142.230.50]) [123.142.230.50]:52856: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.96.160.36
description:
Feb  5 12:23:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.96.160.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
description:
2025-02-05 12:24:01 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:55118: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Feb  5 12:24:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-02-05 12:24:11 dovecot_plain authenticator failed for (163.pool90-160-139.dynamic.orange.es) [90.160.139.163]:43051: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 12:23:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.36.92.64
description:
[2025-02-05 12:23:44 +0100] info [webmaild] 187.36.92.64 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.96.160.36
description:
2025-02-05 12:23:49 dovecot_plain authenticator failed for ([211.96.160.36]) [211.96.160.36]:55928: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
description:
Feb  5 12:23:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.121.5.189
description:
[2025-02-05 12:24:12 +0100] info [webmaild] 176.121.5.189 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.45.44.84
description:
[2025-02-05 12:25:08 +0100] info [cpaneld] 147.45.44.84 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.59.171
description:
[2025-02-05 12:24:35 +0100] info [webmaild] 45.4.59.171 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Feb  5 12:25:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.174.42.7
description:
[2025-02-05 12:25:09 +0100] info [webmaild] 85.174.42.7 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-02-05 12:25:09 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:46260: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.113.43.143
description:
Feb  5 12:25:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.113.43.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  5 12:24:34 ait sshd[524756]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  5 12:24:34 ait sshd[524756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.113.43.143
description:
2025-02-05 12:25:28 dovecot_plain authenticator failed for vps-b909f986.vps.ovh.ca [148.113.43.143]:51120: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-02-05 12:25:52 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:36861: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Feb  5 12:26:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
description:
Feb  5 12:26:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
description:
2025-02-05 12:26:10 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:32784: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-02-05 12:26:04 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:32854: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-05 12:26:26 dovecot_login authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:42315: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Feb  5 12:25:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 12:26:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.14.156.29
description:
[2025-02-05 12:26:14 +0100] info [webmaild] 190.14.156.29 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  5 12:26:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.148.120
description:
[2025-02-05 12:27:11 +0100] info [webmaild] 177.37.148.120 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Feb  5 12:26:27 ait sshd[525513]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  5 12:26:27 ait sshd[525513]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 216.10.245.107
description:
Feb  5 12:26:29 ait sshd[525513]: Failed password for invalid user ait from 216.10.245.107 port 59378 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.168.80
description:
[2025-02-05 12:26:44 +0100] info [webmaild] 177.22.168.80 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.42.49.71
description:
[2025-02-05 12:27:46 +0100] info [webmaild] 179.42.49.71 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-05 12:27:48 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:39422: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.25.73
description:
2025-02-05 12:28:01 dovecot_plain authenticator failed for ([31.173.25.73]) [31.173.25.73]:55528: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-28.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  5 12:27:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.25.73
description:
Feb  5 12:27:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.25.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Feb  5 12:27:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-05 12:27:52 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:37008: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
description:
Feb  5 12:28:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-02-05 12:28:04 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:51738: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
description:
Feb  5 12:28:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.219.58
description:
Feb  5 12:29:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.219.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.223.193.232
description:
2025-02-05 12:29:22 dovecot_plain authenticator failed for (88-223-193-232.init.lt) [88.223.193.232]:44433: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-02-05 12:29:23 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:33120: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
description:
2025-02-05 12:29:13 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:36066: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-02-05 12:29:17 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:52070: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
description:
Feb  5 12:29:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.44.76.103
description:
Feb  5 12:29:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.44.76.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.85.114
description:
2025-02-05 12:28:43 dovecot_plain authenticator failed for (189-20-32-73.customer.tdatabrasil.net.br) [186.200.85.114]:38887: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
description:
2025-02-05 12:28:48 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:53000: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
description:
Feb  5 12:29:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.122.143.166
description:
[2025-02-05 12:29:19 +0100] info [webmaild] 94.122.143.166 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
description:
Feb  5 12:29:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Feb  5 12:29:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
description:
2025-02-05 12:29:26 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:50246: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.143.14.7
description:
Feb  5 12:29:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.143.14.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.63.175
description:
Feb  5 12:29:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.63.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
description:
Feb  5 12:29:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 12:29:25 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-194.tpgi.com.au) [110.175.220.250]:40514: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-02-05 12:29:26 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:34076: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.139.154.159
description:
Feb  5 12:29:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.139.154.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-05 12:29:20 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:64927: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
description:
2025-02-05 12:29:20 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:12931: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
description:
2025-02-05 12:29:22 dovecot_plain authenticator failed for ([121.202.196.6]) [121.202.196.6]:34440: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.208.108.52
description:
2025-02-05 12:29:27 dovecot_plain authenticator failed for ([60.208.108.52]) [60.208.108.52]:49460: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Feb  5 12:28:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.35.251
description:
Feb  5 12:29:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.35.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.142.184.114
description:
Feb  5 12:29:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.142.184.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.142.184.114
description:
2025-02-05 12:29:24 dovecot_plain authenticator failed for ([163.142.184.114]) [163.142.184.114]:57709: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Feb  5 12:29:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.143.14.7
description:
2025-02-05 12:29:19 dovecot_plain authenticator failed for ([117.143.14.7]) [117.143.14.7]:46602: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.96.160.36
description:
Feb  5 12:29:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.96.160.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
description:
Feb  5 12:29:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.139.154.159
description:
2025-02-05 12:29:15 dovecot_plain authenticator failed for ([121.139.154.159]) [121.139.154.159]:50219: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
description:
Feb  5 12:29:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.35.251
description:
2025-02-05 12:29:23 dovecot_plain authenticator failed for ([115.75.35.251]) [115.75.35.251]:36452: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.69.31.50
description:
Feb  5 12:28:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.69.31.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.31.50
description:
2025-02-05 12:28:41 dovecot_plain authenticator failed for ([109.69.31.50]) [109.69.31.50]:55098: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-02-05 12:28:56 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:33814: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  5 12:29:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.219.58
description:
2025-02-05 12:29:23 dovecot_plain authenticator failed for ([46.52.219.58]) [46.52.219.58]:45350: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 12:29:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.44.76.103
description:
2025-02-05 12:29:21 dovecot_plain authenticator failed for 207.44.76.103.res-cmts.hol.ptd.net [207.44.76.103]:50254: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-02-05 12:29:22 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:47373: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.85.114
description:
Feb  5 12:28:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.85.114 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.176.19.17
description:
[2025-02-05 12:28:50 +0100] info [webmaild] 190.176.19.17 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  5 12:29:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.223.193.232
description:
Feb  5 12:29:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.223.193.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
description:
2025-02-05 12:29:25 dovecot_plain authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com [44.211.191.117]:53074: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Feb  5 12:29:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Feb  5 12:29:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.96.160.36
description:
2025-02-05 12:29:25 dovecot_plain authenticator failed for ([211.96.160.36]) [211.96.160.36]:57876: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.208.108.52
description:
Feb  5 12:29:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.208.108.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
description:
Feb  5 12:29:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Feb  5 12:29:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
description:
2025-02-05 12:29:24 dovecot_plain authenticator failed for ([182.135.63.175]) [182.135.63.175]:51492: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
description:
2025-02-05 12:29:25 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:29039: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-02-05 12:29:36 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:34760: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
description:
Feb  5 12:29:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.152.99.171
description:
Feb  5 12:29:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.152.99.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.56.178.158
description:
Feb  5 12:29:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.56.178.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-02-05 12:29:33 dovecot_plain authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:57514: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-02-05 12:29:33 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:50835: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-02-05 12:29:42 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:40330: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.82
description:
Feb  5 12:29:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.207.134
description:
2025-02-05 12:29:29 dovecot_plain authenticator failed for ([221.2.207.134]) [221.2.207.134]:59936: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.129
description:
2025-02-05 12:29:37 dovecot_plain authenticator failed for ([2.55.88.129]) [2.55.88.129]:60602: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Feb  5 12:29:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-02-05 12:29:43 dovecot_plain authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:23454: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.241.139.146
description:
[2025-02-05 12:29:54 +0100] info [webmaild] 191.241.139.146 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Feb  5 12:29:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.161.138.244
description:
Feb  5 12:29:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.161.138.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.98.215.147
description:
Feb  5 12:29:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.98.215.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.178.24
description:
Feb  5 12:29:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.178.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-05 12:30:00 dovecot_plain authenticator failed for ([94.43.224.106]) [2.57.219.2]:40122: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Feb  5 12:29:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-02-05 12:29:35 dovecot_plain authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:51023: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Feb  5 12:29:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-05 12:29:42 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:59938: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-02-05 12:29:28 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:61166: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
description:
2025-02-05 12:29:31 dovecot_plain authenticator failed for ([115.23.23.103]) [115.23.23.103]:49900: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-02-05 12:29:39 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:44670: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-05 12:29:41 dovecot_plain authenticator failed for ([218.98.26.226]) [58.216.101.162]:48735: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.185
description:
2025-02-05 12:29:42 dovecot_plain authenticator failed for ([220.180.171.185]) [220.180.171.185]:43286: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
description:
Feb  5 12:29:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
description:
Feb  5 12:29:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
description:
2025-02-05 12:29:40 dovecot_plain authenticator failed for ([175.136.192.106]) [175.136.192.106]:40890: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
description:
2025-02-05 12:29:45 dovecot_plain authenticator failed for 31-208-136-225.cust.bredband2.com [31.208.136.225]:40033: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Feb  5 12:29:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.178.158
description:
2025-02-05 12:29:29 dovecot_plain authenticator failed for (200-168-190-25.customer.tdatabrasil.net.br) [189.56.178.158]:44781: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.129
description:
Feb  5 12:29:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-02-05 12:29:37 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:38083: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
description:
Feb  5 12:30:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Feb  5 12:29:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Feb  5 12:29:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.185
description:
Feb  5 12:29:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.98.215.147
description:
2025-02-05 12:29:42 dovecot_plain authenticator failed for ([183.98.215.147]) [183.98.215.147]:13306: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-05 12:29:38 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:59429: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Feb  5 12:29:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-02-05 12:29:53 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:16527: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-02-05 12:29:54 dovecot_plain authenticator failed for ([123.142.230.50]) [123.142.230.50]:58442: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-02-05 12:30:06 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:42980: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
description:
Feb  5 12:29:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Feb  5 12:29:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Feb  5 12:29:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
description:
Feb  5 12:29:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
description:
Feb  5 12:29:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
description:
2025-02-05 12:29:34 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:64728: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  5 12:29:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-02-05 12:29:40 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:37870: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
description:
2025-02-05 12:30:02 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:47163: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Feb  5 12:29:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-05 12:29:39 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:60777: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
description:
2025-02-05 12:29:40 dovecot_plain authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:36452: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.152.99.171
description:
2025-02-05 12:29:48 dovecot_plain authenticator failed for syn-184-152-099-171.res.spectrum.com [184.152.99.171]:53053: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-02-05 12:29:56 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:58208: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.255.239
description:
2025-02-05 12:29:38 dovecot_plain authenticator failed for ([117.69.255.239]) [117.69.255.239]:33565: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.82
description:
2025-02-05 12:29:46 dovecot_plain authenticator failed for (nsg-corporate-82.227.187.122.airtel.in) [122.187.227.82]:58359: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Feb  5 12:30:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
description:
Feb  5 12:29:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-02-05 12:29:34 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:32392: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.255.239
description:
Feb  5 12:29:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.255.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Feb  5 12:29:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.24
description:
2025-02-05 12:29:44 dovecot_plain authenticator failed for ([188.59.178.24]) [188.59.178.24]:58116: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
description:
2025-02-05 12:29:43 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:60369: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  5 12:29:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
description:
2025-02-05 12:29:29 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:36515: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  5 12:29:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Feb  5 12:29:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Feb  5 12:30:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Feb  5 12:30:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.134
description:
Feb  5 12:30:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.4.81.206
description:
Feb  5 12:30:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.4.81.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.60.155.58
description:
[2025-02-05 12:30:30 +0100] info [webmaild] 187.60.155.58 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.134
description:
2025-02-05 12:30:50 dovecot_plain authenticator failed for ([27.45.233.134]) [27.45.233.134]:59676: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.15.101.6
description:
2025-02-05 12:30:51 dovecot_plain authenticator failed for ([190.15.101.6]) [190.15.101.6]:33671: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-02-05 12:30:52 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:33132: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.4.81.206
description:
2025-02-05 12:30:55 dovecot_plain authenticator failed for 206.81.4.146.static.wline.lns.sme.cust.swisscom.ch [146.4.81.206]:40607: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Feb  5 12:30:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Feb  5 12:30:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Feb  5 12:31:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-02-05 12:31:03 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:55588: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.237.115.206
description:
2025-02-05 12:31:14 dovecot_plain authenticator failed for (151.237.115.206.pronet.bg) [151.237.115.206]:46914: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-02-05 12:30:37 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:51394: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-02-05 12:30:37 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:40521: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Feb  5 12:30:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-02-05 12:30:55 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:52157: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.174.38
description:
Feb  5 12:31:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.174.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 8.243.28.104
description:
[2025-02-05 12:31:23 +0100] info [webmaild] 8.243.28.104 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-02-05 12:30:36 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:57340: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.15.101.6
description:
Feb  5 12:30:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.15.101.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.237.115.206
description:
Feb  5 12:31:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.237.115.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Feb  5 12:31:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-02-05 12:31:18 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:43422: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Feb  5 12:30:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-02-05 12:30:42 dovecot_plain authenticator failed for ([222.239.231.61]) [222.239.231.61]:22221: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Feb  5 12:31:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 12:31:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.156.203
description:
2025-02-05 12:31:37 dovecot_plain authenticator failed for ([120.197.156.203]) [120.197.156.203]:33603: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-02-05 12:32:18 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:55070: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
description:
Feb  5 12:31:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.106.73.182
description:
[2025-02-05 12:31:52 +0100] info [webmaild] 179.106.73.182 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Feb  5 12:32:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
description:
2025-02-05 12:31:31 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:50822: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.156.203
description:
Feb  5 12:31:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.156.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-02-05 12:31:45 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:55208: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Feb  5 12:31:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Feb  5 12:31:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-02-05 12:33:18 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:63919: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.187.77.179
description:
[2025-02-05 12:32:35 +0100] info [webmaild] 185.187.77.179 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.214.175
description:
Feb  5 12:32:46 ait sshd[528567]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.214.175 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.73.11
description:
[2025-02-05 12:33:09 +0100] info [webmaild] 191.99.73.11 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-02-05 12:32:54 dovecot_plain authenticator failed for (asuaten) [93.159.152.6]:49720: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Feb  5 12:33:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.214.175
description:
Feb  5 12:32:46 ait sshd[528567]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.214.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Feb  5 12:32:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Feb  5 12:33:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-02-05 12:33:32 dovecot_plain authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:51668: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Feb  5 12:34:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.37.26
description:
[2025-02-05 12:34:09 +0100] info [webmaild] 177.86.37.26 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
description:
2025-02-05 12:34:25 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:52386: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-02-05 12:34:46 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:27650: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
description:
2025-02-05 12:35:08 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:33770: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.250.23.208
description:
2025-02-05 12:34:28 dovecot_plain authenticator failed for ([72.250.23.208]) [72.250.23.208]:54066: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.98
description:
Feb  5 12:34:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-02-05 12:34:39 dovecot_plain authenticator failed for ([203.116.95.48]) [203.116.95.48]:53426: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.166.130
description:
2025-02-05 12:34:39 dovecot_plain authenticator failed for 130.sub-166-143-166.myvzw.com [166.143.166.130]:38246: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-05 12:34:53 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:56297: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-02-05 12:34:31 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:43607: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
description:
2025-02-05 12:34:37 dovecot_plain authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:56405: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Feb  5 12:34:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
description:
Feb  5 12:34:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
description:
Feb  5 12:34:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
description:
2025-02-05 12:34:55 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:52962: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.167.42
description:
Feb  5 12:34:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.167.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Feb  5 12:34:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.82
description:
2025-02-05 12:35:03 dovecot_plain authenticator failed for ([183.249.1.82]) [183.249.1.82]:56906: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Feb  5 12:34:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-02-05 12:34:55 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:59746: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
description:
Feb  5 12:34:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 12:34:35 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:50612: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  5 12:34:56 ait sshd[529309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Feb  5 12:34:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.250.23.208
description:
Feb  5 12:34:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.250.23.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  5 12:34:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.109.138
description:
Feb  5 12:35:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.109.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-02-05 12:35:24 dovecot_plain authenticator failed for ([121.202.153.186]) [121.202.153.186]:24420: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.167.42
description:
2025-02-05 12:34:38 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:53816: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.15.58.89
description:
[2025-02-05 12:34:38 +0100] info [webmaild] 157.15.58.89 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
description:
Feb  5 12:34:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.112.159
description:
Feb  5 12:34:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.112.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  5 12:35:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-02-05 12:35:10 dovecot_login authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:33292: 535 Incorrect authentication data (set_id=test@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-02-05 12:34:35 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:45724: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.232.114.71
description:
Feb  5 12:35:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.232.114.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Feb  5 12:34:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
description:
Feb  5 12:35:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Feb  5 12:35:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
description:
2025-02-05 12:34:41 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:40609: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
description:
2025-02-05 12:34:44 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:40271: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.112.159
description:
2025-02-05 12:34:50 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:34752: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
description:
2025-02-05 12:35:10 dovecot_plain authenticator failed for (tagsdev.click) [199.188.103.179]:36974: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-02-05 12:34:40 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:59631: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
description:
2025-02-05 12:34:41 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:34504: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-02-05 12:34:48 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:60810: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-05 12:35:05 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:12295: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.109.138
description:
2025-02-05 12:35:17 dovecot_plain authenticator failed for ([222.190.109.138]) [222.190.109.138]:38657: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 12:34:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Feb  5 12:34:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.82
description:
Feb  5 12:35:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.232.114.71
description:
2025-02-05 12:35:05 dovecot_plain authenticator failed for (189-108-96-183.customer.tdatabrasil.net.br) [200.232.114.71]:55121: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.192.162.237
description:
[2025-02-05 12:35:18 +0100] info [webmaild] 185.192.162.237 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-05 12:34:40 dovecot_plain authenticator failed for ([58.216.101.162]) [58.216.101.162]:39312: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Feb  5 12:34:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  5 12:34:56 ait sshd[529309]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-02-05 12:35:01 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:39454: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
description:
Feb  5 12:35:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Feb  5 12:35:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Feb  5 12:34:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
description:
Feb  5 12:34:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.233.71.237
description:
[2025-02-05 12:35:51 +0100] info [webmaild] 41.233.71.237 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.148
description:
Feb  5 12:35:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.148
description:
2025-02-05 12:35:30 dovecot_login authenticator failed for ([27.40.100.148]) [27.40.100.148]:59786: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.250.60.19
description:
[2025-02-05 12:36:42 +0100] info [webmaild] 41.250.60.19 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 12:37:14 ait sshd[530466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.160.31
description:
Feb  5 12:37:14 ait sshd[530464]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.160.31 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.160.31
description:
Feb  5 12:37:14 ait sshd[530464]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.160.31  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.73.82.201
description:
[2025-02-05 12:37:12 +0100] info [webmaild] 187.73.82.201 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 12:37:14 ait sshd[530466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 12:37:46 ait sshd[530813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.188.166
description:
[2025-02-05 12:37:56 +0100] info [webmaild] 197.185.188.166 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 12:38:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.214.175
description:
Feb  5 12:37:45 ait sshd[530781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.214.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 12:37:46 ait sshd[530813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.37.17
description:
[2025-02-05 12:38:25 +0100] info [webmaild] 37.239.37.17 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.214.175
description:
Feb  5 12:37:45 ait sshd[530781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.214.175


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.208
description:
Feb  5 12:39:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  5 12:38:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.109.214.175
description:
Feb  5 12:38:54 ait sshd[531167]: Failed password for invalid user consulta from 208.109.214.175 port 38182 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
description:
2025-02-05 12:39:09 dovecot_plain authenticator failed for (seure) [65.20.133.208]:56313: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.39.110.20
description:
[2025-02-05 12:39:15 +0100] info [webmaild] 187.39.110.20 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-05 12:38:35 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (adian) [91.56.31.167]:63755: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.214.175
description:
Feb  5 12:38:53 ait sshd[531167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.214.175 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.214.175
description:
Feb  5 12:38:53 ait sshd[531167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.214.175


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.160.31
description:
Feb  5 12:39:51 ait sshd[531749]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.160.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Feb  5 12:40:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Feb  5 12:40:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.228.29.121
description:
[2025-02-05 12:39:44 +0100] info [webmaild] 85.228.29.121 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.160.31
description:
Feb  5 12:39:51 ait sshd[531749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.160.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-02-05 12:40:04 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:34031: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-02-05 12:40:04 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:46802: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Feb  5 12:40:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-02-05 12:40:23 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:42494: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.96.11.230
description:
Feb  5 12:41:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.96.11.230 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 167.235.150.179
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-40.167.235.150.179


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.221.223.159
description:
Feb  5 12:40:56 ait sshd[532544]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.221.223.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.89
description:
2025-02-05 12:40:38 dovecot_login authenticator failed for ([119.207.83.89]) [119.207.83.89]:49937: 535 Incorrect authentication data (set_id=test@aitsmartschool.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.221.223.159
description:
Feb  5 12:40:56 ait sshd[532544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.221.223.159  user=bin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.96.11.230
description:
2025-02-05 12:41:06 dovecot_plain authenticator failed for 230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:40471: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.226.203
description:
[2025-02-05 12:41:10 +0100] info [webmaild] 168.232.226.203 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.42.74
description:
Feb  5 12:41:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.42.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
description:
2025-02-05 12:41:14 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:57538: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-05 12:40:28 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:60886: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.83.89
description:
Feb  5 12:40:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.83.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  5 12:40:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.220.35.81
description:
[2025-02-05 12:40:30 +0100] info [webmaild] 181.220.35.81 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
description:
2025-02-05 12:41:14 dovecot_login authenticator failed for ([58.18.42.74]) [58.18.42.74]:50401: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.180.77.242
description:
[2025-02-05 12:41:51 +0100] info [webmaild] 186.180.77.242 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.232.106.95
description:
[2025-02-05 12:42:23 +0100] info [webmaild] 190.232.106.95 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.160.31
description:
Feb  5 12:41:32 ait sshd[532793]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.160.31 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.160.31
description:
Feb  5 12:41:32 ait sshd[532793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.160.31


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-42.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
description:
Feb  5 12:43:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
description:
2025-02-05 12:43:08 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:35912: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  5 12:43:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
description:
Feb  5 12:43:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.31.242
description:
Feb  5 12:43:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.31.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
description:
2025-02-05 12:43:10 dovecot_plain authenticator failed for ([121.202.196.6]) [121.202.196.6]:5577: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
description:
2025-02-05 12:42:52 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:33984: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.238.78.33
description:
[2025-02-05 12:43:07 +0100] info [webmaild] 197.238.78.33 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.31.242
description:
2025-02-05 12:43:13 dovecot_plain authenticator failed for ([61.169.31.242]) [61.169.31.242]:21309: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
description:
Feb  5 12:42:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-05 12:43:19 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:50462: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.195
description:
Feb  5 12:43:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-02-05 12:43:25 dovecot_plain authenticator failed for (zgr66xoz5ixesr4iohejabe7zb) [77.40.62.195]:17425: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.195
description:
Feb  5 12:43:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-02-05 12:43:31 dovecot_plain authenticator failed for (dk2bqros4hzh9ybnp56ipceewb1xd) [77.40.62.195]:17652: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.87.103.131
description:
Feb  5 12:43:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.87.103.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
description:
2025-02-05 12:43:34 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:36869: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.134.217.55
description:
[2025-02-05 12:43:41 +0100] info [webmaild] 103.134.217.55 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.251.162.9
description:
[2025-02-05 12:44:28 +0100] info [webmaild] 41.251.162.9 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.92.220
description:
Feb  5 12:44:36 ait sshd[534223]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.92.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 12:45:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 12:45:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.92.220
description:
Feb  5 12:44:36 ait sshd[534223]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.92.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.100.36.14
description:
[2025-02-05 12:44:55 +0100] info [webmaild] 200.100.36.14 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
description:
Feb  5 12:46:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
description:
2025-02-05 12:46:15 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:34490: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.110.130.144
description:
[2025-02-05 12:46:24 +0100] info [webmaild] 179.110.130.144 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.182.168
description:
[2025-02-05 12:45:50 +0100] info [webmaild] 187.84.182.168 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.191
description:
[2025-02-05 12:47:21 +0100] info [cpaneld] 104.207.59.191 - ads22b00265y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads22b00265y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.130
description:
[2025-02-05 12:47:22 +0100] info [cpaneld] 156.228.81.130 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.65
description:
[2025-02-05 12:47:25 +0100] info [whostmgrd] 156.228.81.65 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.42.196
description:
2025-02-05 12:46:30 dovecot_plain authenticator failed for 221-120-42-196.emome-ip.hinet.net [221.120.42.196]:56247: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.218.200.88
description:
[2025-02-05 12:47:18 +0100] info [webmaild] 179.218.200.88 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.141
description:
[2025-02-05 12:47:21 +0100] info [cpaneld] 156.228.80.141 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.69
description:
[2025-02-05 12:47:22 +0100] info [cpaneld] 156.228.114.69 - ads22b00265y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads22b00265y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.216
description:
[2025-02-05 12:47:25 +0100] info [cpaneld] 156.228.109.216 - ads22b00265y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads22b00265y (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.120.42.196
description:
Feb  5 12:46:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.120.42.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 12:47:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.182.167
description:
[2025-02-05 12:47:51 +0100] info [webmaild] 45.188.182.167 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.135.116.94
description:
Feb  5 12:47:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.135.116.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Feb  5 12:48:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
description:
2025-02-05 12:48:05 dovecot_plain authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:50696: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 12:48:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Feb  5 12:48:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.122
description:
[2025-02-05 12:47:36 +0100] info [whostmgrd] 156.228.81.122 - ads22b00265y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-02-05 12:47:47 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:53729: 535 Incorrect authentication data (set_id=test@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-02-05 12:48:03 dovecot_plain authenticator failed for ([201.98.208.115]) [201.98.208.115]:37832: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.135.194
description:
Feb  5 12:48:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.135.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.38
description:
[2025-02-05 12:47:26 +0100] info [whostmgrd] 156.228.93.38 - ads22b00265y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.77.43
description:
[2025-02-05 12:47:37 +0100] info [whostmgrd] 156.228.77.43 - ads22b00265y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Feb  5 12:47:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Feb  5 12:47:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.206
description:
Feb  5 12:48:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.21.214.82
description:
Feb  5 12:48:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.21.214.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.148
description:
[2025-02-05 12:47:33 +0100] info [whostmgrd] 104.207.52.148 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.79
description:
[2025-02-05 12:47:36 +0100] info [whostmgrd] 156.228.94.79 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-02-05 12:48:00 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:52329: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
description:
Feb  5 12:48:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.211.97
description:
Feb  5 12:48:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.211.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.211.97
description:
2025-02-05 12:48:10 dovecot_plain authenticator failed for (4zhnkig0hw98yi64ezyrf4vg) [136.169.211.97]:53237: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-02-05 12:48:17 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:58100: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Feb  5 12:48:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  5 12:49:01 ait sshd[536284]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.31.219
description:
Feb  5 12:48:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.31.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.135.194
description:
Feb  5 12:48:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.135.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.21.214.82
description:
Feb  5 12:48:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.21.214.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.218.61
description:
[2025-02-05 12:48:56 +0100] info [webmaild] 131.161.218.61 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  5 12:49:01 ait sshd[536284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Feb  5 12:49:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
description:
2025-02-05 12:48:28 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:33286: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Feb  5 12:48:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.176.41.40
description:
Feb  5 12:48:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.176.41.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.41.40
description:
2025-02-05 12:48:58 dovecot_login authenticator failed for ([178.176.41.40]) [178.176.41.40]:48262: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 12:49:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Feb  5 12:49:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.56.78
description:
[2025-02-05 12:49:32 +0100] info [webmaild] 176.29.56.78 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.69.32.53
description:
[2025-02-05 12:50:00 +0100] info [webmaild] 105.69.32.53 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-02-05 12:50:04 dovecot_plain authenticator failed for (ousion) [185.65.238.250]:45441: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Feb  5 12:49:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-02-05 12:49:28 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:46927: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.138.132.109
description:
Feb  5 12:50:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.138.132.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.60.88
description:
2025-02-05 12:51:04 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.60.88]:7455: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.154.245
description:
2025-02-05 12:51:22 dovecot_plain authenticator failed for ([94.202.154.245]) [94.202.154.245]:49147: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
description:
Feb  5 12:51:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
description:
Feb  5 12:50:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Feb  5 12:50:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.84.60.88
description:
Feb  5 12:51:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.84.60.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 12:51:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.154.245
description:
Feb  5 12:51:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.154.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-02-05 12:50:45 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:39238: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-02-05 12:50:55 dovecot_login authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:46217: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-02-05 12:51:04 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:11038: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
description:
Feb  5 12:51:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
description:
2025-02-05 12:50:45 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:38251: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
description:
2025-02-05 12:51:05 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:44202: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Feb  5 12:51:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.247.227.109
description:
Feb  5 12:50:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.247.227.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-02-05 12:50:45 dovecot_plain authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:36851: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-02-05 12:50:57 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:39740: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Feb  5 12:50:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Feb  5 12:50:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.138.132.109
description:
2025-02-05 12:50:45 dovecot_plain authenticator failed for ([36.138.132.109]) [36.138.132.109]:41218: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
description:
2025-02-05 12:51:16 dovecot_login authenticator failed for ([197.242.170.10]) [197.242.170.10]:58134: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
description:
2025-02-05 12:50:38 dovecot_login authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:53054: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
description:
Feb  5 12:50:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Feb  5 12:51:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
description:
Feb  5 12:51:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
description:
2025-02-05 12:51:12 dovecot_login authenticator failed for ([93.174.229.206]) [93.174.229.206]:48944: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.247.80
description:
Feb  5 12:51:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.247.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
description:
Feb  5 12:50:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.247.227.109
description:
2025-02-05 12:51:01 dovecot_plain authenticator failed for ([223.247.227.109]) [223.247.227.109]:42562: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 12:51:07 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:57430: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
description:
Feb  5 12:51:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-02-05 12:51:20 dovecot_plain authenticator failed for ([202.200.15.1]) [202.200.14.2]:52357: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.235.247.80
description:
2025-02-05 12:51:25 dovecot_login authenticator failed for ([91.235.247.80]) [91.235.247.80]:59212: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.231.216.29
description:
[2025-02-05 12:50:29 +0100] info [webmaild] 37.231.216.29 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-05 12:52:14 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:32934: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.198.191.130
description:
Feb  5 12:52:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.198.191.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
description:
Feb  5 12:52:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
description:
Feb  5 12:52:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 12:52:11 dovecot_plain authenticator failed for ([216.194.174.80]) [216.194.174.27]:26598: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.183
description:
Feb  5 12:52:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Feb  5 12:52:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
description:
Feb  5 12:52:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.96.157.135
description:
[2025-02-05 12:52:03 +0100] info [webmaild] 179.96.157.135 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.173.81
description:
Feb  5 12:52:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.173.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
description:
2025-02-05 12:52:15 dovecot_plain authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:33262: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.229.51.206
description:
Feb  5 12:52:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.229.51.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
description:
Feb  5 12:52:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-02-05 12:52:24 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:52532: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.125.64.126
description:
2025-02-05 12:52:02 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:47870: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
description:
2025-02-05 12:52:05 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:42097: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-02-05 12:52:06 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:6921: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Feb  5 12:52:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
description:
Feb  5 12:52:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Feb  5 12:52:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
description:
2025-02-05 12:52:11 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:49654: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
description:
Feb  5 12:52:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-02-05 12:52:25 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:34956: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-02-05 12:52:11 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:58362: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-02-05 12:52:17 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:38218: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Feb  5 12:52:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-02-05 12:52:05 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:36848: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-02-05 12:52:07 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:23975: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-02-05 12:52:08 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:36805: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
description:
Feb  5 12:52:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Feb  5 12:52:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
description:
Feb  5 12:52:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
description:
2025-02-05 12:52:03 dovecot_plain authenticator failed for (ANO-SH-21.Moscow.access.comstar.ru) [83.237.42.54]:41248: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Feb  5 12:52:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
description:
Feb  5 12:51:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.50.60.15
description:
Feb  5 12:52:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.50.60.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.50.60.15
description:
2025-02-05 12:52:15 dovecot_plain authenticator failed for ([38.50.60.15]) [38.50.60.15]:53459: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
description:
2025-02-05 12:52:06 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:55995: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
description:
Feb  5 12:52:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
description:
Feb  5 12:52:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.136.29.20
description:
2025-02-05 12:52:09 dovecot_plain authenticator failed for ([124.136.29.20]) [124.136.29.20]:15147: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-02-05 12:52:21 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:35840: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Feb  5 12:52:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Feb  5 12:52:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
description:
2025-02-05 12:52:09 dovecot_plain authenticator failed for 111-70-49-185.emome-ip.hinet.net [111.70.49.185]:53068: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
description:
Feb  5 12:52:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
description:
Feb  5 12:52:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.193.110.232
description:
[2025-02-05 12:51:28 +0100] info [webmaild] 85.193.110.232 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
description:
2025-02-05 12:52:03 dovecot_plain authenticator failed for ([65.20.165.83]) [65.20.165.83]:55074: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.24.210.27
description:
2025-02-05 12:52:08 dovecot_plain authenticator failed for ([1.24.210.27]) [1.24.210.27]:48490: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Feb  5 12:52:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Feb  5 12:52:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.191.58.203
description:
Feb  5 12:52:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.191.58.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
description:
Feb  5 12:52:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
description:
Feb  5 12:52:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
description:
2025-02-05 12:52:11 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:36406: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.229.51.206
description:
2025-02-05 12:52:12 dovecot_plain authenticator failed for ([58.229.51.206]) [58.229.51.206]:58500: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
description:
2025-02-05 12:52:21 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:33052: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
description:
2025-02-05 12:52:12 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:57004: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
description:
Feb  5 12:52:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.210
description:
Feb  5 12:52:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-02-05 12:52:24 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:48614: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-02-05 12:52:25 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:45460: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
description:
2025-02-05 12:52:26 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:58758: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Feb  5 12:52:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.210
description:
2025-02-05 12:52:17 dovecot_plain authenticator failed for ([61.169.54.210]) [61.169.54.210]:55881: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-02-05 12:52:21 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:48234: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Feb  5 12:52:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.139.142
description:
2025-02-05 12:52:09 dovecot_plain authenticator failed for ([211.43.139.142]) [211.43.139.142]:50400: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.13.243.101
description:
2025-02-05 12:52:20 dovecot_plain authenticator failed for bl3-243-101.dsl.telepac.pt [213.13.243.101]:3428: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
description:
2025-02-05 12:52:07 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:43271: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.13.243.101
description:
Feb  5 12:52:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.13.243.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Feb  5 12:52:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
description:
2025-02-05 12:52:23 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:39496: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.14.36.47
description:
Feb  5 12:52:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.14.36.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
description:
Feb  5 12:52:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
description:
2025-02-05 12:52:08 dovecot_plain authenticator failed for ([60.14.36.47]) [60.14.36.47]:54000: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-02-05 12:52:13 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:58787: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
description:
Feb  5 12:52:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Feb  5 12:52:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.24.210.27
description:
Feb  5 12:52:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.24.210.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-02-05 12:52:10 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:53532: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
description:
2025-02-05 12:51:27 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:57412: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
description:
Feb  5 12:51:59 ait sshd[537994]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.117.144.194
description:
Feb  5 12:52:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.117.144.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
description:
Feb  5 12:52:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-02-05 12:52:06 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:32860: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-02-05 12:52:26 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:42749: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
description:
2025-02-05 12:52:25 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:5838: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
description:
Feb  5 12:52:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
description:
Feb  5 12:52:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Feb  5 12:52:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.168.113
description:
Feb  5 12:52:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.168.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.81
description:
2025-02-05 12:52:07 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.81]:48033: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
description:
2025-02-05 12:52:15 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:48188: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Feb  5 12:52:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-02-05 12:52:11 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:56661: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
description:
2025-02-05 12:52:20 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:41526: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.160
description:
Feb  5 12:51:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.185
description:
Feb  5 12:52:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.117.144.194
description:
2025-02-05 12:52:19 dovecot_plain authenticator failed for ([211.117.144.194]) [211.117.144.194]:57248: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.125.64.126
description:
Feb  5 12:52:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.125.64.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Feb  5 12:52:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Feb  5 12:52:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.136.29.20
description:
Feb  5 12:52:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.136.29.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-02-05 12:52:07 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:9770: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  5 12:52:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.236.170.3
description:
Feb  5 12:52:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.236.170.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.236.170.3
description:
2025-02-05 12:52:16 dovecot_plain authenticator failed for ([4.236.170.3]) [4.236.170.3]:63526: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
description:
Feb  5 12:52:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-05 12:52:07 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:55907: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-02-05 12:52:09 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:47552: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.224.123.153
description:
Feb  5 12:52:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.224.123.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
description:
2025-02-05 12:52:24 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:59596: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Feb  5 12:52:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
description:
Feb  5 12:51:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Feb  5 12:52:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Feb  5 12:52:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Feb  5 12:52:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
description:
2025-02-05 12:52:22 dovecot_plain authenticator failed for ([195.222.57.183]) [195.222.57.183]:43544: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
description:
Feb  5 12:52:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.168.113
description:
2025-02-05 12:52:25 dovecot_plain authenticator failed for ([219.145.168.113]) [219.145.168.113]:49164: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
description:
2025-02-05 12:51:32 dovecot_login authenticator failed for ([119.203.251.186]) [119.203.251.186]:40084: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.160
description:
2025-02-05 12:51:45 dovecot_login authenticator failed for ([218.149.228.160]) [218.149.228.160]:48465: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-02-05 12:52:05 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:60040: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
description:
2025-02-05 12:51:30 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:55646: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Feb  5 12:52:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
description:
Feb  5 12:52:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
description:
2025-02-05 12:52:22 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:45822: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Feb  5 12:52:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-02-05 12:52:06 dovecot_plain authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:44866: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.123.153
description:
2025-02-05 12:52:07 dovecot_plain authenticator failed for ([24.224.123.153]) [24.224.123.153]:46975: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.58.203
description:
2025-02-05 12:52:22 dovecot_plain authenticator failed for ([60.191.58.203]) [60.191.58.203]:46318: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
description:
Feb  5 12:52:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.139.142
description:
Feb  5 12:52:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.139.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
description:
2025-02-05 12:52:07 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:41260: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-02-05 12:52:20 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:33418: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Feb  5 12:52:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-02-05 12:52:22 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:10937: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
description:
Feb  5 12:51:59 ait sshd[537994]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
description:
2025-02-05 12:52:04 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:52414: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-02-05 12:52:04 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:38048: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-02-05 12:52:34 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:48864: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.20.6.2
description:
2025-02-05 12:52:39 dovecot_plain authenticator failed for (189-44-19-161.customer.tdatabrasil.net.br) [189.20.6.2]:40061: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
description:
2025-02-05 12:52:50 dovecot_login authenticator failed for (22.69.85.194.in-addr.arpa) [194.85.69.22]:57858: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.134.110
description:
Feb  5 12:52:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.134.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
description:
2025-02-05 12:52:31 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:34161: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
description:
Feb  5 12:52:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-02-05 12:53:25 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:57068: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.123.92.130
description:
2025-02-05 12:52:29 dovecot_plain authenticator failed for ([50.123.92.130]) [50.123.92.130]:58175: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-05 12:52:30 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:37336: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Feb  5 12:52:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
description:
2025-02-05 12:52:36 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:42726: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  5 12:52:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
description:
2025-02-05 12:52:27 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:35330: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Feb  5 12:53:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.103.117
description:
Feb  5 12:52:29 ait sshd[538232]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.103.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.85.69.22
description:
Feb  5 12:52:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.85.69.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
description:
Feb  5 12:53:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
description:
Feb  5 12:52:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.71.173.185
description:
[2025-02-05 12:52:34 +0100] info [webmaild] 186.71.173.185 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
description:
2025-02-05 12:52:38 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:49925: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-02-05 12:52:42 dovecot_plain authenticator failed for ([186.200.158.42]) [186.200.158.42]:34911: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
description:
2025-02-05 12:52:48 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:57549: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 12:52:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-02-05 12:52:28 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:44615: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.103.117
description:
Feb  5 12:52:29 ait sshd[538232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.103.117  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.35.217.44
description:
2025-02-05 12:53:12 dovecot_login authenticator failed for net-2-35-217-44.cust.vodafonedsl.it [2.35.217.44]:35552: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-02-05 12:53:25 dovecot_login authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:61350: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
description:
Feb  5 12:52:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
description:
Feb  5 12:52:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  5 12:52:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-02-05 12:53:12 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:47674: 535 Incorrect authentication data (set_id=ads18a00007y)


