# incident

plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.40.30.101
description:
[2025-02-05 09:35:34 +0100] info [webmaild] 89.40.30.101 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.245.95.11
description:
Feb  5 09:35:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.245.95.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
description:
Feb  5 09:36:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
description:
2025-02-05 09:35:22 dovecot_plain authenticator failed for ([180.104.103.146]) [180.104.103.146]:53926: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.123.172
description:
2025-02-05 09:35:29 dovecot_plain authenticator failed for ([163.179.123.172]) [163.179.123.172]:35247: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Feb  5 09:35:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.42.133.74
description:
Feb  5 09:35:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.42.133.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
description:
2025-02-05 09:35:24 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:59099: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
description:
Feb  5 09:35:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.202.91.52
description:
2025-02-05 09:35:37 dovecot_plain authenticator failed for (host-196.202.91.52-static.tedata.net) [196.202.91.52]:51535: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
description:
2025-02-05 09:35:44 dovecot_plain authenticator failed for (90.109.33.58.broad.xw.sh.dynamic.163data.com.cn) [58.33.109.90]:53829: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Feb  5 09:35:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  5 09:35:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
description:
Feb  5 09:35:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.239.241.198
description:
Feb  5 09:35:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.239.241.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.232.225
description:
2025-02-05 09:35:22 dovecot_plain authenticator failed for ([220.80.232.225]) [220.80.232.225]:50780: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.202.91.52
description:
Feb  5 09:35:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.202.91.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.134.32.74
description:
Feb  5 09:35:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.134.32.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Feb  5 09:35:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
description:
Feb  5 09:35:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-02-05 09:35:24 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:53712: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.190.147.29
description:
2025-02-05 09:35:39 dovecot_plain authenticator failed for static-47-190-147-29.dlls.tx.frontiernet.net [47.190.147.29]:62859: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.71.134
description:
2025-02-05 09:35:49 dovecot_plain authenticator failed for (20118071134.host.telemar.net.br) [201.18.71.134]:35159: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.134.32.74
description:
2025-02-05 09:35:22 dovecot_plain authenticator failed for ([222.134.32.74]) [222.134.32.74]:50780: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 09:35:26 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:56283: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
description:
2025-02-05 09:35:32 dovecot_plain authenticator failed for ([178.178.222.56]) [178.178.222.56]:54306: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.231.212.78
description:
Feb  5 09:35:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.231.212.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
description:
Feb  5 09:35:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
description:
2025-02-05 09:35:41 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:35720: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.224.70
description:
Feb  5 09:36:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.224.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.224.70
description:
2025-02-05 09:36:39 dovecot_plain authenticator failed for ([112.164.224.70]) [112.164.224.70]:53210: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Feb  5 09:36:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-02-05 09:36:52 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:37754: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.99.149.170
description:
[2025-02-05 09:36:36 +0100] info [webmaild] 105.99.149.170 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  5 09:37:21 ait sshd[449722]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.97.6.150
description:
[2025-02-05 09:37:26 +0100] info [webmaild] 212.97.6.150 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  5 09:37:31 ait sshd[449756]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  5 09:37:31 ait sshd[449756]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.175.120.25
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-38.83.175.120.25


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.26.93.52
description:
[2025-02-05 09:38:11 +0100] info [webmaild] 186.26.93.52 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.59.34.245
description:
Feb  5 09:38:18 ait sshd[449958]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.59.34.245


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.59.34.245
description:
Feb  5 09:38:18 ait sshd[449958]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.59.34.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  5 09:37:21 ait sshd[449722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 09:37:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Feb  5 09:38:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-02-05 09:38:08 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:51660: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Feb  5 09:38:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-02-05 09:38:23 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:58386: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  5 09:38:31 ait sshd[449984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24  user=bin


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.158.22.104
description:
[2025-02-05 09:38:42 +0100] info [webmaild] 185.158.22.104 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.141.229
description:
Feb  5 09:38:57 ait sshd[450165]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.141.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.141.229
description:
Feb  5 09:38:57 ait sshd[450165]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.141.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 09:38:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
description:
Feb  5 09:39:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  5 09:38:31 ait sshd[449984]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 72.255.40.207
description:
[2025-02-05 09:39:20 +0100] info [webmaild] 72.255.40.207 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-02-05 09:40:16 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:46690: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.18.14.2
description:
[2025-02-05 09:39:54 +0100] info [webmaild] 103.18.14.2 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-02-05 09:40:15 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:49070: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Feb  5 09:40:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Feb  5 09:40:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.59.34.245
description:
Feb  5 09:39:27 ait sshd[450316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.59.34.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.59.34.245
description:
Feb  5 09:39:27 ait sshd[450316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.59.34.245


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 09:40:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.114
description:
Feb  5 09:40:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-02-05 09:40:29 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:37101: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-05 09:40:30 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:38753: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-02-05 09:40:54 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:38432: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.10.94
description:
Feb  5 09:41:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.10.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Feb  5 09:40:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  5 09:40:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.53.234
description:
Feb  5 09:40:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.53.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
description:
2025-02-05 09:40:39 dovecot_login authenticator failed for ([190.223.53.234]) [190.223.53.234]:52871: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.63.203.111
description:
Feb  5 09:40:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.63.203.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.63.203.111
description:
2025-02-05 09:40:49 dovecot_login authenticator failed for lmontsouris-655-1-111-111.w90-63.abo.wanadoo.fr [90.63.203.111]:46650: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Feb  5 09:40:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.65
description:
Feb  5 09:40:51 ait sshd[451251]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.65


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.55.191.7
description:
[2025-02-05 09:41:04 +0100] info [webmaild] 191.55.191.7 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.209.153
description:
Feb  5 09:41:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.10.94
description:
2025-02-05 09:41:16 dovecot_login authenticator failed for ([223.71.10.94]) [223.71.10.94]:42651: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.114
description:
2025-02-05 09:40:37 dovecot_login authenticator failed for ([104.241.236.114]) [104.241.236.114]:51689: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Feb  5 09:40:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.65
description:
Feb  5 09:40:51 ait sshd[451251]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-02-05 09:40:55 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:35065: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.209.153
description:
2025-02-05 09:41:08 dovecot_login authenticator failed for ([39.174.209.153]) [39.174.209.153]:52556: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.108.90.193
description:
[2025-02-05 09:41:57 +0100] info [webmaild] 103.108.90.193 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
description:
Feb  5 09:41:27 ait sshd[451397]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
description:
Feb  5 09:41:27 ait sshd[451397]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.137.21
description:
Feb  5 09:41:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.137.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.137.21
description:
2025-02-05 09:41:32 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:48444: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.80.0.5
description:
[2025-02-05 09:41:34 +0100] info [webmaild] 201.80.0.5 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-02-05 09:42:23 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:39247: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
description:
2025-02-05 09:43:08 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:41951: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Feb  5 09:42:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
description:
Feb  5 09:42:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.9.85.232
description:
[2025-02-05 09:42:32 +0100] info [webmaild] 177.9.85.232 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
description:
2025-02-05 09:42:34 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:35940: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
description:
Feb  5 09:43:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
description:
Feb  5 09:43:38 ait sshd[452181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.150.71
description:
Feb  5 09:43:39 ait sshd[452207]: pam_imunify(sshd:auth): [IM360_RBL] The IP 85.130.150.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 09:43:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
description:
Feb  5 09:43:38 ait sshd[452181]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 85.130.150.71
description:
Feb  5 09:43:39 ait sshd[452207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=85.130.150.71


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  5 09:44:19 ait sshd[452422]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-02-05 09:43:30 dovecot_plain authenticator failed for ([178.72.83.179]) [178.72.83.179]:59774: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  5 09:44:19 ait sshd[452422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.98.117.24
description:
[2025-02-05 09:43:52 +0100] info [webmaild] 79.98.117.24 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 182.61.10.212
description:
Feb  5 09:44:21 ait sshd[452422]: Failed password for invalid user naric from 182.61.10.212 port 44486 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.63.84
description:
[2025-02-05 09:44:22 +0100] info [webmaild] 168.205.63.84 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.128.121.29
description:
[2025-02-05 09:44:45 +0100] info [webmaild] 186.128.121.29 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-45.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.246.184
description:
[2025-02-05 09:45:19 +0100] info [webmaild] 168.196.246.184 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.229.118.208
description:
Feb  5 09:45:39 ait sshd[453091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.118.208


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.173.106.95
description:
Feb  5 09:46:04 ait sshd[453343]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.173.106.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.229.118.208
description:
Feb  5 09:45:39 ait sshd[453091]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.229.118.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 09:45:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Feb  5 09:45:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-02-05 09:45:55 dovecot_plain authenticator failed for (wriver) [77.51.214.170]:53535: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.173.106.95
description:
Feb  5 09:46:04 ait sshd[453343]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.173.106.95  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
description:
2025-02-05 09:47:00 dovecot_login authenticator failed for ([182.139.39.150]) [182.139.39.150]:57734: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  5 09:47:13 ait sshd[453704]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  5 09:47:13 ait sshd[453704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Feb  5 09:47:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
description:
Feb  5 09:46:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
description:
2025-02-05 09:46:40 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:37122: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.207.212.110
description:
[2025-02-05 09:46:55 +0100] info [webmaild] 41.207.212.110 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
description:
Feb  5 09:46:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.133.21.52
description:
[2025-02-05 09:48:01 +0100] info [webmaild] 187.133.21.52 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.56
description:
Feb  5 09:48:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
description:
2025-02-05 09:48:12 dovecot_plain authenticator failed for ([178.178.222.56]) [178.178.222.56]:51090: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-02-05 09:47:20 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:65389: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.169.253
description:
[2025-02-05 09:47:25 +0100] info [webmaild] 102.219.169.253 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.84.211
description:
Feb  5 09:48:09 ait sshd[453977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.96.84.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.96.84.211
description:
Feb  5 09:48:09 ait sshd[453977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.96.84.211


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.164.163
description:
[2025-02-05 09:47:24 +0100] info [webmaild] 177.131.164.163 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Feb  5 09:48:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-02-05 09:49:05 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:45878: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.58.159
description:
Feb  5 09:48:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.58.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.202.91.52
description:
2025-02-05 09:48:58 dovecot_plain authenticator failed for (host-196.202.91.52-static.tedata.net) [196.202.91.52]:34141: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-02-05 09:49:06 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:35552: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-02-05 09:48:41 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:55516: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.137.38.119
description:
Feb  5 09:48:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.137.38.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.216.72
description:
Feb  5 09:48:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.216.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.71.58.159
description:
2025-02-05 09:48:55 dovecot_login authenticator failed for ([45.71.58.159]) [45.71.58.159]:49468: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.202.91.52
description:
Feb  5 09:48:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.202.91.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Feb  5 09:49:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
description:
2025-02-05 09:49:11 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:58505: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.15.163.18
description:
Feb  5 09:49:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.15.163.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.137.38.119
description:
2025-02-05 09:48:44 dovecot_plain authenticator failed for ([36.137.38.119]) [36.137.38.119]:35383: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.216.72
description:
2025-02-05 09:48:50 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:43090: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-02-05 09:48:52 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:58370: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
description:
2025-02-05 09:49:19 dovecot_plain authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:64838: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Feb  5 09:49:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Feb  5 09:49:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-02-05 09:49:06 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:19074: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-02-05 09:49:07 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:50944: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.10.20
description:
Feb  5 09:49:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.10.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 09:48:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Feb  5 09:48:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Feb  5 09:49:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-02-05 09:49:23 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:35568: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.84.211
description:
Feb  5 09:49:49 ait sshd[454751]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.96.84.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.96.84.211
description:
Feb  5 09:49:49 ait sshd[454751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.96.84.211


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 09:49:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.2.11
description:
[2025-02-05 09:49:36 +0100] info [webmaild] 45.163.2.11 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 09:50:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.26.112
description:
[2025-02-05 09:50:08 +0100] info [webmaild] 170.245.26.112 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.229.65
description:
[2025-02-05 09:50:14 +0100] info [webmaild] 177.55.229.65 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Feb  5 09:49:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 09:50:40 ait sshd[455129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.65
description:
Feb  5 09:50:43 ait sshd[455178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.17.208.36
description:
[2025-02-05 09:50:47 +0100] info [webmaild] 201.17.208.36 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.96.84.211
description:
Feb  5 09:51:18 ait sshd[455401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.96.84.211


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.65
description:
Feb  5 09:50:43 ait sshd[455178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.65


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 109.234.166.135
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-50.109.234.166.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.118.230
description:
2025-02-05 09:51:05 dovecot_plain authenticator failed for ([182.70.118.230]) [182.70.118.230]:51432: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  5 09:50:40 ait sshd[455129]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.118.230
description:
Feb  5 09:51:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.118.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.240.104
description:
Feb  5 09:51:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.240.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.240.104
description:
2025-02-05 09:51:15 dovecot_plain authenticator failed for (104.240.199.112.unknown.m1.com.sg) [112.199.240.104]:37876: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.84.211
description:
Feb  5 09:51:18 ait sshd[455401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.96.84.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 09:51:44 ait sshd[455534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41  user=lemsas


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
description:
Feb  5 09:52:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.73.130.43
description:
Feb  5 09:52:17 ait sshd[455734]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.73.130.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.73.130.43
description:
Feb  5 09:52:17 ait sshd[455734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.73.130.43  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 27.96.84.211
description:
Feb  5 09:51:21 ait sshd[455401]: Failed password for invalid user nvivek from 27.96.84.211 port 36866 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 09:51:44 ait sshd[455534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
description:
2025-02-05 09:52:18 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:33598: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-02-05 09:52:38 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:36350: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.146.148.173
description:
Feb  5 09:52:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.146.148.173 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.23.34.218
description:
[2025-02-05 09:52:23 +0100] info [webmaild] 191.23.34.218 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Feb  5 09:52:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.140.127.215
description:
Feb  5 09:52:38 ait sshd[455838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.140.127.215  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.221.48
description:
Feb  5 09:52:53 ait sshd[456074]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.221.48  user=bin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.146.148.173
description:
2025-02-05 09:52:42 dovecot_plain authenticator failed for ([129.146.148.173]) [129.146.148.173]:32960: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
description:
Feb  5 09:52:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
description:
2025-02-05 09:52:50 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:55674: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.221.48
description:
Feb  5 09:52:53 ait sshd[456074]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.221.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.29.207.11
description:
[2025-02-05 09:52:53 +0100] info [webmaild] 77.29.207.11 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.221.115.164
description:
[2025-02-05 09:52:57 +0100] info [webmaild] 62.221.115.164 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-05 09:53:25 dovecot_plain authenticator failed for (centarte) [207.188.157.230]:58234: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.42.205
description:
[2025-02-05 09:53:32 +0100] info [webmaild] 45.174.42.205 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.157.246.26
description:
Feb  5 09:53:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.157.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  5 09:53:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
description:
2025-02-05 09:54:57 dovecot_login authenticator failed for ([124.246.94.219]) [124.246.94.219]:32962: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-02-05 09:55:12 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:41635: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.140.127.215
description:
Feb  5 09:55:17 ait sshd[457090]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.140.127.215  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.141.229
description:
Feb  5 09:54:45 ait sshd[456599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.141.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.141.229
description:
Feb  5 09:54:45 ait sshd[456599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.141.229  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.94.219
description:
Feb  5 09:54:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.94.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Feb  5 09:55:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.241.135.25
description:
Feb  5 09:55:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.241.135.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-02-05 09:56:02 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:47762: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.68.225.143
description:
Feb  5 09:56:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.68.225.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-02-05 09:56:15 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:54564: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-02-05 09:56:00 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:54282: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Feb  5 09:56:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.4.84.125
description:
Feb  5 09:56:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.4.84.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-05 09:56:02 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:42840: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Feb  5 09:56:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Feb  5 09:56:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.140.127.215
description:
Feb  5 09:55:31 ait sshd[457141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.140.127.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-02-05 09:55:51 dovecot_plain authenticator failed for (phlently) [64.72.74.162]:42973: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Feb  5 09:55:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.71.121.54
description:
2025-02-05 09:56:14 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:47218: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.135.25
description:
2025-02-05 09:55:49 dovecot_login authenticator failed for syn-067-241-135-025.res.spectrum.com [67.241.135.25]:49312: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.98.249.9
description:
2025-02-05 09:56:02 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:48381: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Feb  5 09:56:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.51.244.35
description:
[2025-02-05 09:56:02 +0100] info [webmaild] 38.51.244.35 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.40.194
description:
2025-02-05 09:56:14 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:42842: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.48.135
description:
[2025-02-05 09:56:19 +0100] info [webmaild] 191.37.48.135 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
description:
2025-02-05 09:56:19 dovecot_plain authenticator failed for 217.42.246.220.static.netvigator.com [220.246.42.217]:65384: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.183.114.175
description:
Feb  5 09:55:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.183.114.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
description:
2025-02-05 09:55:40 dovecot_plain authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:36313: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Feb  5 09:55:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.6.250.109
description:
Feb  5 09:55:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.6.250.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.109.20.192
description:
Feb  5 09:55:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.109.20.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.98.249.9
description:
Feb  5 09:56:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.98.249.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Feb  5 09:56:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-02-05 09:56:20 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:41248: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.68.225.143
description:
2025-02-05 09:56:05 dovecot_login authenticator failed for s143-225-68-64.ssvec.az.wi-power.com [64.68.225.143]:39389: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.183.114.175
description:
2025-02-05 09:55:28 dovecot_plain authenticator failed for ([179.183.114.175]) [179.183.114.175]:33640: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Feb  5 09:55:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-02-05 09:55:54 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:59868: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  5 09:56:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-02-05 09:55:35 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:35210: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.71.121.54
description:
Feb  5 09:56:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.71.121.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.248.40.194
description:
Feb  5 09:56:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.248.40.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
description:
2025-02-05 09:56:12 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:26004: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.222.80.77
description:
2025-02-05 09:55:50 dovecot_login authenticator failed for ([91.222.80.77]) [91.222.80.77]:59729: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Feb  5 09:55:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.109.20.192
description:
2025-02-05 09:55:51 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:49356: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-02-05 09:56:02 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:56214: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Feb  5 09:55:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.84.125
description:
2025-02-05 09:56:02 dovecot_login authenticator failed for d4-50-125-84.nap.wideopenwest.com [50.4.84.125]:53010: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Feb  5 09:56:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.217
description:
Feb  5 09:56:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.194.148.132
description:
Feb  5 09:55:26 ait sshd[457143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.194.148.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Feb  5 09:55:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.144
description:
Feb  5 09:55:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Feb  5 09:55:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Feb  5 09:56:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-02-05 09:55:46 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:41808: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
description:
2025-02-05 09:55:50 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:55293: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-02-05 09:55:52 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:37696: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-02-05 09:56:08 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:50524: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.6.250.109
description:
2025-02-05 09:56:01 dovecot_login authenticator failed for 109.250.6.51.dyn.plus.net [51.6.250.109]:35088: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-02-05 09:56:05 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:52026: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.194.148.132
description:
Feb  5 09:55:26 ait sshd[457143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.194.148.132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.183.207.64
description:
[2025-02-05 09:55:29 +0100] info [webmaild] 179.183.207.64 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Feb  5 09:55:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-02-05 09:55:46 dovecot_login authenticator failed for ([91.122.31.214]) [91.122.31.214]:45980: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.17.253.219
description:
[2025-02-05 09:56:39 +0100] info [webmaild] 187.17.253.219 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-02-05 09:56:35 dovecot_login authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:41602: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.8
description:
Feb  5 09:56:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.8
description:
2025-02-05 09:56:41 dovecot_plain authenticator failed for ([5.30.225.8]) [5.30.225.8]:54667: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
description:
Feb  5 09:56:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 09:56:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Feb  5 09:56:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.151.38.224
description:
2025-02-05 09:56:23 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:62728: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Feb  5 09:56:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.74
description:
Feb  5 09:56:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.74
description:
2025-02-05 09:56:36 dovecot_login authenticator failed for ([104.241.230.74]) [104.241.230.74]:35837: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 09:57:13 ait sshd[457798]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Feb  5 09:56:59 ait sshd[457746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=bin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.151.38.224
description:
Feb  5 09:56:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.151.38.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-02-05 09:56:23 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:54834: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Feb  5 09:56:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-02-05 09:56:30 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:50100: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
description:
2025-02-05 09:56:52 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:39552: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 09:57:13 ait sshd[457798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  5 09:57:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.108.144.21
description:
[2025-02-05 09:58:11 +0100] info [webmaild] 105.108.144.21 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.46
description:
2025-02-05 09:58:11 dovecot_login authenticator failed for (He4FhlLuAT) [185.241.208.46]:58826: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-05 09:57:30 dovecot_plain authenticator failed for (supre) [207.188.157.230]:8646: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.102.90
description:
Feb  5 09:57:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.102.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
description:
2025-02-05 09:57:33 dovecot_plain authenticator failed for ([117.32.102.90]) [117.32.102.90]:57230: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Feb  5 09:57:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-02-05 09:57:42 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:61638: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.127.134.129
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-58.103.127.134.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.46
description:
Feb  5 09:58:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.234
description:
Feb  5 09:59:17 ait sshd[458453]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.71.27.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.46
description:
Feb  5 09:58:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.24.42.0
description:
[2025-02-05 09:58:42 +0100] info [webmaild] 191.24.42.0 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.46
description:
2025-02-05 09:58:41 dovecot_login authenticator failed for (1PHuMN) [185.241.208.46]:49893: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.235.246.45
description:
[2025-02-05 09:59:16 +0100] info [webmaild] 196.235.246.45 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 09:59:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.184.110.180
description:
[2025-02-05 09:58:43 +0100] info [webmaild] 177.184.110.180 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.71.27.234
description:
Feb  5 09:59:17 ait sshd[458453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.27.234  user=bin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.25.156
description:
Feb  5 09:59:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.25.156 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-00.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-02-05 09:59:27 dovecot_plain authenticator failed for ([50.224.22.135]) [50.224.22.135]:40837: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.25.156
description:
2025-02-05 09:59:50 dovecot_plain authenticator failed for ([222.116.25.156]) [222.116.25.156]:40941: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-05 10:00:13 dovecot_plain authenticator failed for (mailles) [207.188.157.230]:22508: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Feb  5 09:59:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-02-05 09:59:28 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:51821: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.218.48
description:
2025-02-05 09:59:33 dovecot_plain authenticator failed for ([46.45.218.48]) [46.45.218.48]:55568: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-02-05 09:59:38 dovecot_plain authenticator failed for ([196.28.226.123]) [196.28.226.123]:52539: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  5 09:59:38 ait sshd[458568]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Feb  5 09:59:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  5 10:00:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.218.48
description:
Feb  5 09:59:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
description:
Feb  5 09:59:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
description:
Feb  5 09:59:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
description:
2025-02-05 09:59:42 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:61815: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Feb  5 10:00:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.211.97.51
description:
Feb  5 10:01:12 ait sshd[459995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.211.97.51  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.82.206
description:
[2025-02-05 10:01:14 +0100] info [cpaneld] 156.228.82.206 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.130
description:
[2025-02-05 10:01:16 +0100] info [cpaneld] 156.228.93.130 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.36.251.201
description:
[2025-02-05 10:00:51 +0100] info [webmaild] 179.36.251.201 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
description:
Feb  5 10:01:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.84.146
description:
[2025-02-05 10:01:16 +0100] info [cpaneld] 156.228.84.146 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
description:
2025-02-05 10:01:15 dovecot_plain authenticator failed for ([36.37.181.181]) [36.37.181.181]:49860: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.148.41
description:
Feb  5 10:01:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.148.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.184.56.199
description:
Feb  5 10:01:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.184.56.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.56.199
description:
2025-02-05 10:01:09 dovecot_plain authenticator failed for ([112.184.56.199]) [112.184.56.199]:53452: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.135.96.213
description:
Feb  5 10:00:55 ait sshd[459639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.135.96.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.187.146.68
description:
Feb  5 10:00:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.187.146.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.251.1.130
description:
[2025-02-05 10:01:20 +0100] info [webmaild] 186.251.1.130 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-02-05 10:00:50 dovecot_plain authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:54524: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.243.163
description:
Feb  5 10:00:58 ait sshd[459775]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.243.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.135.96.213
description:
Feb  5 10:00:55 ait sshd[459639]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.135.96.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
description:
2025-02-05 10:01:01 dovecot_plain authenticator failed for ([38.187.146.68]) [38.187.146.68]:44830: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 195.178.110.65
description:
Feb  5 10:01:12 ait sshd[459998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=195.178.110.65


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.243.163
description:
Feb  5 10:00:58 ait sshd[459775]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.243.163  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.65
description:
Feb  5 10:01:12 ait sshd[459998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 195.178.110.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.105
description:
[2025-02-05 10:01:15 +0100] info [cpaneld] 156.228.116.105 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
description:
Feb  5 10:01:19 ait sshd[460091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.148.41
description:
2025-02-05 10:01:22 dovecot_plain authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:58636: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.57.210
description:
[2025-02-05 10:01:25 +0100] info [cpaneld] 104.207.57.210 - assdas3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas3 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-02-05 10:01:32 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:53660: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.183
description:
[2025-02-05 10:01:32 +0100] info [whostmgrd] 104.207.38.183 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.52
description:
[2025-02-05 10:01:32 +0100] info [whostmgrd] 104.207.63.52 - assdas1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Feb  5 10:01:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.58
description:
[2025-02-05 10:01:28 +0100] info [cpaneld] 156.228.119.58 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.60
description:
[2025-02-05 10:01:29 +0100] info [whostmgrd] 104.207.55.60 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.119
description:
[2025-02-05 10:01:34 +0100] info [whostmgrd] 104.207.50.119 - assdas1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.179
description:
[2025-02-05 10:01:26 +0100] info [whostmgrd] 156.228.94.179 - assdas3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.111.59.146
description:
2025-02-05 10:01:26 dovecot_plain authenticator failed for ([75.111.59.146]) [75.111.59.146]:60686: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.43.130
description:
[2025-02-05 10:01:28 +0100] info [whostmgrd] 104.207.43.130 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.227.214.33
description:
Feb  5 10:01:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.227.214.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.125
description:
[2025-02-05 10:01:28 +0100] info [whostmgrd] 156.228.106.125 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 10:01:38 ait sshd[460243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.86.56
description:
[2025-02-05 10:01:24 +0100] info [whostmgrd] 156.228.86.56 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.113.151
description:
[2025-02-05 10:01:26 +0100] info [cpaneld] 156.228.113.151 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.204
description:
[2025-02-05 10:01:26 +0100] info [whostmgrd] 156.228.114.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.6
description:
[2025-02-05 10:01:27 +0100] info [cpaneld] 104.207.52.6 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.155
description:
[2025-02-05 10:01:27 +0100] info [cpaneld] 104.207.54.155 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.98.55
description:
[2025-02-05 10:01:27 +0100] info [cpaneld] 156.228.98.55 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.79.166
description:
[2025-02-05 10:01:23 +0100] info [cpaneld] 156.228.79.166 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas4 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.89
description:
[2025-02-05 10:01:33 +0100] info [whostmgrd] 104.207.41.89 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.76.186
description:
[2025-02-05 10:01:42 +0100] info [whostmgrd] 156.228.76.186 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.240
description:
[2025-02-05 10:01:45 +0100] info [whostmgrd] 156.228.93.240 - assdas4 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.91.148
description:
[2025-02-05 10:01:23 +0100] info [cpaneld] 156.228.91.148 - assdas3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.24
description:
[2025-02-05 10:01:33 +0100] info [whostmgrd] 156.228.116.24 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.111.59.146
description:
Feb  5 10:01:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.111.59.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.63.226
description:
[2025-02-05 10:01:26 +0100] info [cpaneld] 104.207.63.226 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.46.98
description:
[2025-02-05 10:01:28 +0100] info [whostmgrd] 104.207.46.98 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.188.8
description:
[2025-02-05 10:01:31 +0100] info [webmaild] 170.83.188.8 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.66
description:
[2025-02-05 10:01:34 +0100] info [whostmgrd] 104.207.47.66 - assdas1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 10:01:38 ait sshd[460243]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.66
description:
Feb  5 10:01:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Feb  5 10:02:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-02-05 10:02:11 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:50928: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-02-05 10:01:49 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:41292: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.50.160
description:
[2025-02-05 10:01:25 +0100] info [cpaneld] 104.207.50.160 - assdas3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.138
description:
[2025-02-05 10:01:27 +0100] info [whostmgrd] 104.207.58.138 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Feb  5 10:01:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.86.217
description:
[2025-02-05 10:01:35 +0100] info [whostmgrd] 156.228.86.217 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.227.214.33
description:
2025-02-05 10:01:37 dovecot_plain authenticator failed for ([182.227.214.33]) [182.227.214.33]:36120: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 187.237.178.130
description:
Feb  5 10:01:21 ait sshd[460091]: Failed password for invalid user test from 187.237.178.130 port 40742 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.44
description:
[2025-02-05 10:01:27 +0100] info [cpaneld] 156.228.95.44 - assdas1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.32
description:
[2025-02-05 10:01:30 +0100] info [whostmgrd] 156.228.95.32 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.97.199
description:
[2025-02-05 10:01:33 +0100] info [whostmgrd] 156.228.97.199 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.79
description:
[2025-02-05 10:01:24 +0100] info [cpaneld] 156.228.111.79 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
description:
2025-02-05 10:01:57 dovecot_plain authenticator failed for ([181.233.93.3]) [181.233.93.66]:59753: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.157
description:
[2025-02-05 10:01:31 +0100] info [cpaneld] 156.228.85.157 - assdas1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas1 (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Feb  5 10:01:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Feb  5 10:01:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.100
description:
[2025-02-05 10:01:23 +0100] info [cpaneld] 156.228.94.100 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.29
description:
[2025-02-05 10:01:31 +0100] info [whostmgrd] 104.207.45.29 - assdas3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.41.203
description:
[2025-02-05 10:01:35 +0100] info [whostmgrd] 104.207.41.203 - assdas3 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-02-05 10:01:39 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:42762: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-02-05 10:01:53 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:60364: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.100
description:
[2025-02-05 10:01:28 +0100] info [cpaneld] 104.207.54.100 - assdas2 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.133
description:
[2025-02-05 10:01:30 +0100] info [cpaneld] 104.207.39.133 - assdas1 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user assdas1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.191.7.173
description:
[2025-02-05 10:02:05 +0100] info [webmaild] 191.191.7.173 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 10:02:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
description:
Feb  5 10:03:19 ait sshd[461052]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
description:
Feb  5 10:03:19 ait sshd[461052]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.66.55.50
domain: u3l.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home/titlemas/public_html/U3L.US/wp-admin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
description:
Feb  5 10:03:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.54.114.13
description:
[2025-02-05 10:03:34 +0100] info [webmaild] 94.54.114.13 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Feb  5 10:03:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 10:03:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
description:
Feb  5 10:03:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Feb  5 10:03:53 ait sshd[461210]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.229.118.208
description:
Feb  5 10:04:18 ait sshd[461429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.118.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
description:
2025-02-05 10:03:29 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:47012: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.183.40.132
description:
[2025-02-05 10:04:11 +0100] info [webmaild] 191.183.40.132 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
description:
Feb  5 10:03:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 10:03:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
description:
2025-02-05 10:03:55 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:34312: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 208.109.10.69
description:
Feb  5 10:03:21 ait sshd[461052]: Failed password for invalid user aitstaff from 208.109.10.69 port 57184 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
description:
2025-02-05 10:03:26 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:50396: 535 Incorrect authentication data (set_id=test@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-02-05 10:03:38 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:54344: 535 Incorrect authentication data (set_id=test)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 157.66.55.50
domain: u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:10-04.157.66.55.50||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Feb  5 10:03:53 ait sshd[461210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.78.214
description:
[2025-02-05 10:04:02 +0100] info [webmaild] 191.243.78.214 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.28.237
description:
Feb  5 10:04:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.28.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.28.237
description:
2025-02-05 10:04:13 dovecot_login authenticator failed for host-79-21-28-237.retail.telecomitalia.it [79.21.28.237]:35147: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.229.118.208
description:
Feb  5 10:04:18 ait sshd[461429]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.229.118.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.97.132.7
description:
Feb  5 10:05:14 ait sshd[462009]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.97.132.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-02-05 10:04:29 dovecot_login authenticator failed for ([136.38.202.60]) [136.38.202.60]:37476: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.228.80
description:
[2025-02-05 10:04:44 +0100] info [webmaild] 143.202.228.80 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.66.55.50
domain: u3l.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/autoload_classmap.php||SC:/home/titlemas/public_html/U3L.US/wp-content


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
description:
Feb  5 10:05:14 ait sshd[462009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Feb  5 10:04:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
description:
2025-02-05 10:06:19 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:53469: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
description:
2025-02-05 10:05:32 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:51702: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
description:
Feb  5 10:05:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
description:
2025-02-05 10:06:01 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:54118: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
description:
Feb  5 10:05:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
description:
Feb  5 10:06:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.136.187
description:
[2025-02-05 10:06:10 +0100] info [webmaild] 45.166.136.187 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
description:
2025-02-05 10:05:43 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:48216: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
description:
Feb  5 10:05:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-05 10:06:36 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:23251: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.156.228.231
description:
[2025-02-05 10:06:40 +0100] info [webmaild] 105.156.228.231 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
description:
Feb  5 10:06:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
description:
2025-02-05 10:06:48 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:39505: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  5 10:06:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.105.9.102
description:
[2025-02-05 10:07:25 +0100] info [webmaild] 77.105.9.102 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.42.18
description:
47.128.42.18 - - [05/Feb/2025:10:07:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17766483 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/open/index.php?Itemid=435&id=312&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.42.18


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.128.132.236
description:
[2025-02-05 10:08:02 +0100] info [webmaild] 186.128.132.236 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-02-05 10:08:38 dovecot_plain authenticator failed for (mical) [102.53.15.180]:44005: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.148.6.46
description:
Feb  5 10:08:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.148.6.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.148.6.46
description:
2025-02-05 10:08:42 dovecot_plain authenticator failed for (phydroned) [62.148.6.46]:56233: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.250.209.197
description:
[2025-02-05 10:08:47 +0100] info [webmaild] 196.250.209.197 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.167.238
description:
2025-02-05 10:09:05 dovecot_plain authenticator failed for ([65.76.167.238]) [65.76.167.238]:33344: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 10:08:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Feb  5 10:08:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
description:
2025-02-05 10:09:23 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:41038: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.151.29
description:
[2025-02-05 10:10:06 +0100] info [webmaild] 45.236.151.29 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.137.67.108
description:
[2025-02-05 10:09:19 +0100] info [webmaild] 103.137.67.108 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 10:09:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
description:
Feb  5 10:09:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Feb  5 10:10:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.163.103
description:
Feb  5 10:11:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.163.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-02-05 10:10:45 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:59494: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 10:10:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.203.84
description:
[2025-02-05 10:10:52 +0100] info [webmaild] 201.71.203.84 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-02-05 10:10:33 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:59468: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Feb  5 10:10:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
description:
2025-02-05 10:11:13 dovecot_plain authenticator failed for (manny) [65.20.163.103]:43635: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Feb  5 10:10:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-02-05 10:10:38 dovecot_plain authenticator failed for 9498.telnet.bg (callerres) [87.254.165.100]:49562: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.149.154
description:
Feb  5 10:11:36 ait sshd[464690]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.56.149.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.135.255.121
description:
[2025-02-05 10:11:36 +0100] info [webmaild] 103.135.255.121 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.131.100.165
description:
[2025-02-05 10:12:07 +0100] info [webmaild] 103.131.100.165 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.169.113
description:
Feb  5 10:12:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.169.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.56.149.154
description:
Feb  5 10:11:36 ait sshd[464690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.56.149.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
description:
2025-02-05 10:13:18 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:46004: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
description:
2025-02-05 10:12:20 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:42774: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Feb  5 10:12:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-02-05 10:12:44 dovecot_plain authenticator failed for (fichal) [109.108.95.66]:39874: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.219.14.187
description:
[2025-02-05 10:12:52 +0100] info [webmaild] 45.219.14.187 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
description:
Feb  5 10:12:19 ait sshd[464974]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 10:12:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-05 10:12:42 dovecot_plain authenticator failed for ([58.216.101.162]) [58.216.101.162]:48969: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.174.136
description:
Feb  5 10:13:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.174.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
description:
Feb  5 10:13:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
description:
Feb  5 10:12:19 ait sshd[464974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Feb  5 10:12:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.174.136
description:
2025-02-05 10:13:05 dovecot_plain authenticator failed for ([117.159.174.136]) [117.159.174.136]:56236: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.230.228.21
description:
[2025-02-05 10:13:28 +0100] info [webmaild] 94.230.228.21 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 10:13:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.88.10.10
description:
Feb  5 10:14:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.88.10.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.86.198
description:
Feb  5 10:13:31 ait sshd[465426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.86.198


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Feb  5 10:14:09 ait sshd[465612]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.235.158
description:
Feb  5 10:14:11 ait sshd[465725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.235.158


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.88.10.10
description:
2025-02-05 10:14:14 dovecot_plain authenticator failed for ([102.88.10.10]) [102.88.10.10]:51938: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.27.252
description:
Feb  5 10:13:45 ait sshd[465456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.27.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.208
description:
[2025-02-05 10:14:19 +0100] info [webmaild] 84.54.71.208 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Feb  5 10:14:09 ait sshd[465612]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.27.252
description:
Feb  5 10:13:45 ait sshd[465456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.27.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 10:13:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  5 10:13:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-05 10:14:00 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:36692: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.178.20
description:
Feb  5 10:15:00 ait sshd[465919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.178.20


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Feb  5 10:15:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-02-05 10:15:17 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:59896: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.161
description:
[2025-02-05 10:14:50 +0100] info [webmaild] 198.163.193.161 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.178.20
description:
Feb  5 10:15:00 ait sshd[465919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.178.20 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  5 10:14:49 ait sshd[465868]: error: kex_exchange_identification: read: Connection reset by peer


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-14.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  5 10:15:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-02-05 10:16:15 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:45418: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Feb  5 10:15:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.123.32
description:
Feb  5 10:15:54 ait sshd[466555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.123.32  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Feb  5 10:15:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.128.249.19
description:
Feb  5 10:15:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.128.249.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Feb  5 10:15:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.123.32
description:
Feb  5 10:15:54 ait sshd[466555]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.123.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Feb  5 10:15:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-05 10:16:05 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (60-242-84-9.static.tpgi.com.au) [110.175.220.250]:36784: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.122.101.129
description:
Feb  5 10:16:17 ait sshd[466777]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.122.101.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.14.129.6
description:
[2025-02-05 10:15:33 +0100] info [webmaild] 103.14.129.6 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-05 10:15:39 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:35104: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-02-05 10:15:41 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:42082: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.128.249.19
description:
2025-02-05 10:15:55 dovecot_plain authenticator failed for 217-128-249-19.ftth.fr.orangecustomers.net (aunpan) [217.128.249.19]:59928: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.247.241.121
description:
[2025-02-05 10:16:06 +0100] info [webmaild] 170.247.241.121 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-02-05 10:15:41 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:53312: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Feb  5 10:16:05 ait sshd[466625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Feb  5 10:16:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.122.101.129
description:
Feb  5 10:16:17 ait sshd[466777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.101.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-02-05 10:15:28 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:24530: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-02-05 10:15:59 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:35707: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  5 10:16:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Feb  5 10:16:05 ait sshd[466625]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.200.47.13
description:
Feb  5 10:17:01 ait sshd[466959]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.200.47.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.200.47.13
description:
Feb  5 10:17:01 ait sshd[466959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.200.47.13


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.101.129
description:
Feb  5 10:16:20 ait sshd[466777]: Failed password for invalid user dev from 134.122.101.129 port 32882 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.208.102.58
description:
[2025-02-05 10:16:51 +0100] info [webmaild] 185.208.102.58 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.76.95.152
description:
2025-02-05 10:18:13 dovecot_plain authenticator failed for ([62.76.95.152]) [62.76.95.152]:44532: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
description:
Feb  5 10:17:28 ait sshd[467259]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Feb  5 10:18:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Feb  5 10:18:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 150.107.106.35
description:
[2025-02-05 10:17:21 +0100] info [webmaild] 150.107.106.35 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-02-05 10:18:14 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:28011: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.201
description:
Feb  5 10:18:03 ait sshd[467395]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.201 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.201
description:
Feb  5 10:18:03 ait sshd[467395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.201  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.35.66.80
description:
[2025-02-05 10:18:03 +0100] info [webmaild] 37.35.66.80 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.76.95.152
description:
Feb  5 10:18:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.76.95.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-02-05 10:18:15 dovecot_plain authenticator failed for (taxyraches) [82.84.122.203]:60574: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
description:
2025-02-05 10:20:09 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:50361: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-02-05 10:20:13 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:46859: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Feb  5 10:20:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Feb  5 10:19:38 ait sshd[468373]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.181.81.77
description:
Feb  5 10:20:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.181.81.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.42.116.185
description:
Feb  5 10:20:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.42.116.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Feb  5 10:20:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-02-05 10:20:23 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:56487: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Feb  5 10:19:38 ait sshd[468373]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 134.122.101.129
description:
Feb  5 10:19:43 ait sshd[468403]: Failed password for invalid user ventas01 from 134.122.101.129 port 33208 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
description:
2025-02-05 10:20:07 dovecot_plain authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:32820: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Feb  5 10:20:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-02-05 10:20:21 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:54806: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-02-05 10:20:25 dovecot_plain authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:1444: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-02-05 10:20:13 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:51220: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Feb  5 10:20:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.156.55
description:
[2025-02-05 10:19:27 +0100] info [webmaild] 170.81.156.55 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.214.142.75
description:
[2025-02-05 10:19:57 +0100] info [webmaild] 177.214.142.75 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
description:
2025-02-05 10:20:01 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:4033: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
description:
2025-02-05 10:20:04 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:58887: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
description:
Feb  5 10:19:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.181.81.77
description:
2025-02-05 10:20:05 dovecot_plain authenticator failed for ([125.181.81.77]) [125.181.81.77]:11019: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
description:
Feb  5 10:20:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Feb  5 10:20:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.122.101.129
description:
Feb  5 10:19:41 ait sshd[468403]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.122.101.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.122.101.129
description:
Feb  5 10:19:41 ait sshd[468403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.122.101.129


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.240.84.120
description:
Feb  5 10:19:44 ait sshd[468433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.240.84.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.232.65
description:
Feb  5 10:20:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.232.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Feb  5 10:21:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.157.25
description:
2025-02-05 10:21:16 dovecot_plain authenticator failed for ([218.14.157.25]) [218.14.157.25]:57399: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Feb  5 10:21:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.150.182
description:
Feb  5 10:21:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.150.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.150.182
description:
2025-02-05 10:21:12 dovecot_plain authenticator failed for ([182.176.150.182]) [182.176.150.182]:49427: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
description:
2025-02-05 10:21:10 dovecot_plain authenticator failed for (abts-north-static-104.21.176.122.airtelbroadband.in) [122.176.21.104]:40661: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
description:
2025-02-05 10:21:11 dovecot_plain authenticator failed for ([103.47.74.210]) [103.47.74.210]:38728: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Feb  5 10:21:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.82.20.241
description:
Feb  5 10:20:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.82.20.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.21.104
description:
Feb  5 10:21:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.21.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-02-05 10:21:08 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:45729: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
description:
Feb  5 10:21:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-02-05 10:21:13 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:1303: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
description:
Feb  5 10:21:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-05 10:21:24 dovecot_plain authenticator failed for ([159.223.250.131]) [161.35.200.202]:57854: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
description:
Feb  5 10:21:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Feb  5 10:21:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-02-05 10:21:15 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:56795: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.86.2.18
description:
2025-02-05 10:21:24 dovecot_plain authenticator failed for (host103-86-2-18.airwir.com) [103.86.2.18]:58212: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.183.247
description:
Feb  5 10:21:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.183.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-02-05 10:21:25 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:52008: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-02-05 10:21:26 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:33364: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
description:
Feb  5 10:21:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
description:
Feb  5 10:21:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 10:21:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-02-05 10:21:09 dovecot_plain authenticator failed for ([103.65.227.72]) [114.130.181.74]:45591: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Feb  5 10:21:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
description:
Feb  5 10:21:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
description:
2025-02-05 10:21:22 dovecot_plain authenticator failed for (l5-130-173-74.novotelecom.ru) [5.130.173.74]:42394: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
description:
Feb  5 10:20:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.200.47.13
description:
Feb  5 10:20:48 ait sshd[469337]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.200.47.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-02-05 10:21:11 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:57088: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Feb  5 10:21:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.37.179.83
description:
2025-02-05 10:21:26 dovecot_plain authenticator failed for ([200.37.179.83]) [200.37.179.83]:59528: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
description:
Feb  5 10:21:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-02-05 10:21:13 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:54334: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-02-05 10:21:14 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:49217: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.86.2.18
description:
Feb  5 10:21:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.86.2.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Feb  5 10:21:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.87.230
description:
Feb  5 10:21:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.87.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-02-05 10:21:17 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:55646: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Feb  5 10:21:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.196.221.74
description:
Feb  5 10:21:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.196.221.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-02-05 10:21:20 dovecot_plain authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:13629: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.206.255.25
description:
[2025-02-05 10:20:42 +0100] info [webmaild] 186.206.255.25 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Feb  5 10:21:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Feb  5 10:21:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.59
description:
Feb  5 10:21:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.59
description:
2025-02-05 10:21:20 dovecot_plain authenticator failed for (58-115-53-59.twt1.com.tw) [58.115.53.59]:56378: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Feb  5 10:21:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-02-05 10:21:10 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:47732: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Feb  5 10:21:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Feb  5 10:21:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
description:
2025-02-05 10:21:12 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:46225: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.132.229.196
description:
Feb  5 10:21:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.132.229.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.234.219
description:
2025-02-05 10:21:26 dovecot_plain authenticator failed for (estointernet.in) [103.123.234.219]:36780: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Feb  5 10:21:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-02-05 10:21:19 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:49748: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Feb  5 10:21:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-02-05 10:21:14 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:63181: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-02-05 10:21:15 dovecot_plain authenticator failed for ([58.216.101.162]) [58.216.101.162]:45026: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Feb  5 10:21:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Feb  5 10:21:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
description:
Feb  5 10:21:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Feb  5 10:21:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
description:
2025-02-05 10:21:10 dovecot_plain authenticator failed for syn-047-037-177-099.res.spectrum.com [47.37.177.99]:36710: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.132.229.196
description:
2025-02-05 10:21:24 dovecot_plain authenticator failed for ([185.132.229.196]) [185.132.229.196]:37924: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.87.230
description:
2025-02-05 10:21:15 dovecot_plain authenticator failed for ([1.31.87.230]) [1.31.87.230]:56560: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-05 10:21:15 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:45848: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.170.200
description:
Feb  5 10:21:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.170.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Feb  5 10:20:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-02-05 10:21:11 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:55464: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.234.219
description:
Feb  5 10:21:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.234.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 10:21:11 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:42350: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.37.179.83
description:
Feb  5 10:21:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.37.179.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-02-05 10:21:24 dovecot_plain authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:56828: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-02-05 10:21:11 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:43768: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
description:
2025-02-05 10:21:23 dovecot_plain authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:47304: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
description:
Feb  5 10:21:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.242.78
description:
2025-02-05 10:21:24 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:37604: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Feb  5 10:21:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Feb  5 10:21:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Feb  5 10:21:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.106.37
description:
[2025-02-05 10:21:15 +0100] info [webmaild] 45.228.106.37 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
description:
2025-02-05 10:21:24 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:53261: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-02-05 10:21:10 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:37802: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
description:
2025-02-05 10:21:17 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:41664: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Feb  5 10:21:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
description:
2025-02-05 10:20:31 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:46437: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Feb  5 10:21:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-02-05 10:21:14 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:49272: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
description:
2025-02-05 10:21:10 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:53018: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Feb  5 10:21:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  5 10:21:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
description:
2025-02-05 10:21:22 dovecot_plain authenticator failed for ([188.168.86.6]) [188.168.86.6]:59300: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.242.78
description:
Feb  5 10:21:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.242.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
description:
2025-02-05 10:20:30 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:37702: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Feb  5 10:21:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Feb  5 10:21:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
description:
2025-02-05 10:20:45 dovecot_plain authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:55086: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-02-05 10:20:56 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:58090: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
description:
2025-02-05 10:21:24 dovecot_plain authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:41901: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.200.47.13
description:
Feb  5 10:20:48 ait sshd[469337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.200.47.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-02-05 10:21:18 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:46825: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
description:
Feb  5 10:21:06 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.130.173.74
description:
Feb  5 10:21:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.130.173.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Feb  5 10:21:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
description:
2025-02-05 10:21:13 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:57090: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.196.221.74
description:
2025-02-05 10:21:20 dovecot_plain authenticator failed for ([159.196.221.74]) [159.196.221.74]:13486: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
description:
Feb  5 10:21:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-02-05 10:21:22 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:52303: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
description:
Feb  5 10:21:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-02-05 10:21:08 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:57025: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.220.149.129
description:
Feb  5 10:21:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.220.149.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Feb  5 10:21:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.157.25
description:
Feb  5 10:21:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.157.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
description:
2025-02-05 10:21:15 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:53092: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-02-05 10:21:26 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:40727: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-02-05 10:21:08 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:42736: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-02-05 10:21:11 dovecot_plain authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:43061: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.129
description:
2025-02-05 10:21:13 dovecot_plain authenticator failed for ([118.220.149.129]) [118.220.149.129]:41772: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.170.200
description:
2025-02-05 10:21:24 dovecot_plain authenticator failed for (broadband-37.204-170-200.ip.moscow.rt.ru) [37.204.170.200]:51093: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
description:
Feb  5 10:20:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Feb  5 10:21:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.183.247
description:
2025-02-05 10:21:27 dovecot_plain authenticator failed for ([207.188.183.247]) [207.188.183.247]:39868: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-02-05 10:21:27 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:61309: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Feb  5 10:21:33 ait sshd[469785]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.107.198
description:
Feb  5 10:21:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.107.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-02-05 10:21:59 dovecot_plain authenticator failed for ([202.200.15.1]) [202.200.14.2]:40354: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Feb  5 10:21:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  5 10:21:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.56.115.66
description:
2025-02-05 10:21:29 dovecot_plain authenticator failed for ([103.56.115.66]) [103.56.115.66]:55910: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-02-05 10:21:30 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:52321: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
description:
Feb  5 10:21:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Feb  5 10:21:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-02-05 10:21:30 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:45306: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-02-05 10:21:30 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:37646: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.127.195
description:
Feb  5 10:21:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-02-05 10:21:38 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:40842: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Feb  5 10:21:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.43.209.206
description:
[2025-02-05 10:21:59 +0100] info [webmaild] 5.43.209.206 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Feb  5 10:21:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-05 10:21:32 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:37260: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Feb  5 10:21:33 ait sshd[469785]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
description:
2025-02-05 10:21:33 dovecot_plain authenticator failed for ([196.189.124.229]) [196.189.124.229]:55782: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.97.186
description:
Feb  5 10:21:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.97.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.170.149
description:
Feb  5 10:21:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.170.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.41.218
description:
2025-02-05 10:21:35 dovecot_plain authenticator failed for ([218.94.41.218]) [218.94.41.218]:48428: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Feb  5 10:21:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Feb  5 10:21:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-02-05 10:21:35 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:39012: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.97.186
description:
2025-02-05 10:21:36 dovecot_plain authenticator failed for ([211.228.97.186]) [211.228.97.186]:58303: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.149
description:
2025-02-05 10:21:37 dovecot_plain authenticator failed for ([218.149.170.149]) [218.149.170.149]:47148: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-02-05 10:21:50 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:34916: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.107.198
description:
2025-02-05 10:21:54 dovecot_plain authenticator failed for ([187.92.178.105]) [187.8.107.198]:46093: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Feb  5 10:21:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.228.174
description:
2025-02-05 10:22:09 dovecot_plain authenticator failed for (abts-tn-static-174.228.165.122.airtelbroadband.in) [122.165.228.174]:55418: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Feb  5 10:21:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-02-05 10:21:28 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:58016: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.123.27.87
description:
Feb  5 10:21:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.123.27.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.41.218
description:
Feb  5 10:21:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.41.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-02-05 10:21:33 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:38006: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.149.220.148
description:
2025-02-05 10:21:34 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.148]:41616: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Feb  5 10:21:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-02-05 10:21:29 dovecot_plain authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:63456: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Feb  5 10:21:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.228.174
description:
Feb  5 10:22:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.228.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.115.66
description:
Feb  5 10:21:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.56.115.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-02-05 10:21:27 dovecot_plain authenticator failed for ([95.79.20.9]) [95.79.20.9]:49454: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.149.220.148
description:
Feb  5 10:21:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.149.220.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.123.27.87
description:
2025-02-05 10:21:31 dovecot_plain authenticator failed for ([183.123.27.87]) [183.123.27.87]:54482: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-02-05 10:21:34 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:56752: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.127.195
description:
2025-02-05 10:21:37 dovecot_plain authenticator failed for ([39.164.127.195]) [39.164.127.195]:57292: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
description:
Feb  5 10:21:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
description:
2025-02-05 10:21:41 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:50374: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.108.214.151
description:
[2025-02-05 10:22:30 +0100] info [webmaild] 190.108.214.151 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.178.20
description:
Feb  5 10:23:06 ait sshd[470119]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.178.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.178.20
description:
Feb  5 10:23:06 ait sshd[470119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.178.20


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.87.12.165
description:
[2025-02-05 10:23:24 +0100] info [webmaild] 201.87.12.165 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.127
description:
Feb  5 10:23:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
description:
Feb  5 10:24:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.203
domain: tit-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:10-23.108.165.243.203||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.149.125.227
description:
2025-02-05 10:23:56 dovecot_plain authenticator failed for ([197.149.125.227]) [197.149.125.227]:51958: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 108.165.243.203
domain: tit-edu.us
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:6.65||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.82.179
description:
[2025-02-05 10:23:59 +0100] info [webmaild] 170.79.82.179 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.121.214.105
description:
Feb  5 10:24:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.121.214.105 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
description:
Feb  5 10:23:33 ait sshd[470164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193  user=bin


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 108.165.243.203
domain: tit-edu.us
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/admin.php?||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.121.214.105
description:
2025-02-05 10:24:03 dovecot_plain authenticator failed for ([176.121.214.105]) [176.121.214.105]:36567: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
description:
Feb  5 10:23:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  5 10:23:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.149.125.227
description:
Feb  5 10:23:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.149.125.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Feb  5 10:23:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
description:
2025-02-05 10:24:20 dovecot_plain authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:40023: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
description:
2025-02-05 10:23:37 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:52037: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
description:
2025-02-05 10:23:41 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:18242: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-02-05 10:23:57 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:16664: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.203
domain: tit-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/images/about.php||SC:/home/titlemas/public_html/TIT-EDU.US/wp-includes


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 185.223.152.8
domain: tit-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:10-24.185.223.152.8||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-05 10:23:38 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:62598: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.223.152.8
domain: tit-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/titlemas/public_html/TIT-EDU.US/wp-admin


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
description:
Feb  5 10:23:33 ait sshd[470164]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Feb  5 10:25:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-02-05 10:25:01 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:60060: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  5 10:25:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-02-05 10:25:16 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:40676: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.219
domain: tit-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:10-24.108.165.243.219||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.211
domain: tit-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:10-25.108.165.243.211||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.96.101.124
description:
2025-02-05 10:25:10 dovecot_plain authenticator failed for ([186.96.101.124]) [186.96.101.124]:55328: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-02-05 10:25:20 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:59157: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.219
domain: tit-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/titlemas/public_html/TIT-EDU.US/wp-admin


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 108.165.243.219
domain: tit-edu.us
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.31.11.105
description:
[2025-02-05 10:24:55 +0100] info [webmaild] 103.31.11.105 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Feb  5 10:24:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-02-05 10:25:00 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:51293: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
description:
Feb  5 10:25:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-05 10:25:09 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:31797: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.185.25.97
description:
[2025-02-05 10:25:23 +0100] info [webmaild] 103.185.25.97 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  5 10:24:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.101.124
description:
Feb  5 10:25:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.101.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Feb  5 10:24:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.211
domain: tit-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/about.php||SC:/home/titlemas/public_html/TIT-EDU.US/wp-content


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Feb  5 10:25:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-05 10:24:57 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:47493: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
description:
2025-02-05 10:25:11 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:54980: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.133.158.175
description:
Feb  5 10:25:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.133.158.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.158.175
description:
2025-02-05 10:25:23 dovecot_login authenticator failed for ([195.133.158.175]) [195.133.158.175]:48148: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.8.218.54
description:
2025-02-05 10:25:35 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:45547: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.190.150.4
description:
Feb  5 10:26:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.190.150.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.235.137.240
description:
[2025-02-05 10:26:08 +0100] info [webmaild] 105.235.137.240 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350296
name: IM360: Block access to the shell
abuser: 108.165.243.211
domain: tit-edu.us
description:
IM360: Block access to the shell||MV:/ticket/vendor/htmlawed/htmlawed/gel4y.php||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 108.165.243.213
domain: tit-edu.us
description:
IM360 WAF: Block interaction with malicious plugin||RSV:6.65||T:APACHE||SC:/home/titlemas/public_html/TIT-EDU.US/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Feb  5 10:25:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
description:
2025-02-05 10:26:06 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (gastamihy) [69.123.219.82]:58493: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 10:25:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
description:
2025-02-05 10:26:02 dovecot_plain authenticator failed for ([203.190.150.4]) [203.190.150.4]:44800: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
description:
Feb  5 10:26:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.8.218.54
description:
Feb  5 10:25:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.8.218.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-02-05 10:25:40 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:52555: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.54.90
description:
47.128.54.90 - - [05/Feb/2025:10:26:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26917175 HTTP/1.1" 302 0 iric.us "http://iric.us/index.php?Itemid=164&id=68&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.90


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.27.252
description:
Feb  5 10:27:12 ait sshd[471488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.27.252


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.10.59.193
description:
[2025-02-05 10:26:48 +0100] info [webmaild] 177.10.59.193 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.27.252
description:
Feb  5 10:27:12 ait sshd[471488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.27.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 143.198.83.211
domain: 136.243.145.84
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/wp-conflg.php||SC:/var/www/html/wp-content


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.182.126.186
description:
Feb  5 10:27:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.182.126.186 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.161.223.168
description:
[2025-02-05 10:27:58 +0100] info [webmaild] 95.161.223.168 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.118.94
description:
Feb  5 10:28:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.118.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.118.94
description:
2025-02-05 10:28:11 dovecot_login authenticator failed for ([211.228.118.94]) [211.228.118.94]:33681: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.39.38.144
description:
[2025-02-05 10:27:28 +0100] info [webmaild] 102.39.38.144 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.55.85
description:
47.128.55.85 - - [05/Feb/2025:10:28:23 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20362833 HTTP/2.0" 302 0 iric.us "https://iric.us/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.55.85


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.162.249
description:
Feb  5 10:28:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.162.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.166.60
description:
[2025-02-05 10:28:42 +0100] info [webmaild] 179.0.166.60 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.162.249
description:
2025-02-05 10:28:42 dovecot_login authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:46108: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.215
description:
[2025-02-05 10:29:19 +0100] info [whostmgrd] 156.228.110.215 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.161.41
description:
[2025-02-05 10:29:23 +0100] info [webmaild] 177.22.161.41 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-29.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-02-05 10:29:39 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:52708: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.71.27.234
description:
Feb  5 10:29:56 ait sshd[472774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.27.234  user=bin


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.45
description:
Feb  5 10:30:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  5 10:29:58 ait sshd[472786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.157.70.63
description:
[2025-02-05 10:30:01 +0100] info [webmaild] 179.157.70.63 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Feb  5 10:29:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.81
description:
2025-02-05 10:29:39 dovecot_login authenticator failed for (nsg-corporate-81.230.187.122.airtel.in) [122.187.230.81]:40232: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.23.178.20
description:
Feb  5 10:29:44 ait sshd[472690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.23.178.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
description:
2025-02-05 10:29:50 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:49108: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.234
description:
Feb  5 10:29:56 ait sshd[472774]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.71.27.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.45
description:
2025-02-05 10:30:09 dovecot_plain authenticator failed for (graly) [65.20.147.45]:35046: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Feb  5 10:29:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-02-05 10:29:29 dovecot_login authenticator failed for ([200.202.250.46]) [200.202.250.46]:39062: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.23.178.20
description:
Feb  5 10:29:44 ait sshd[472690]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.23.178.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
description:
Feb  5 10:29:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  5 10:29:58 ait sshd[472786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.128.108
description:
Feb  5 10:30:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.128.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
description:
2025-02-05 10:30:56 dovecot_plain authenticator failed for ([14.45.217.249]) [14.45.217.249]:36652: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
description:
2025-02-05 10:31:01 dovecot_plain authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:64292: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-02-05 10:31:03 dovecot_plain authenticator failed for (dsl-178-35-155-182.avtlg.ru) [178.35.155.182]:37871: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  5 10:31:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
description:
Feb  5 10:30:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.13.99.66
description:
2025-02-05 10:30:52 dovecot_plain authenticator failed for ([210.13.99.68]) [210.13.99.66]:30979: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.55.59
description:
2025-02-05 10:31:17 dovecot_plain authenticator failed for ([223.171.55.59]) [223.171.55.59]:59946: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.156.254
description:
Feb  5 10:31:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.156.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-05 10:30:52 dovecot_plain authenticator failed for ([27.223.100.94]) [27.223.100.90]:48902: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.65.117
description:
2025-02-05 10:30:56 dovecot_plain authenticator failed for ([183.238.65.117]) [183.238.65.117]:42717: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Feb  5 10:31:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Feb  5 10:31:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.72.83.179
description:
2025-02-05 10:31:04 dovecot_plain authenticator failed for ([178.72.83.179]) [178.72.83.179]:51984: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Feb  5 10:31:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-02-05 10:30:38 dovecot_plain authenticator failed for (palmike) [65.20.155.91]:56334: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-05 10:31:07 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:45466: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.107.198
description:
2025-02-05 10:31:10 dovecot_plain authenticator failed for ([187.92.178.105]) [187.8.107.198]:42688: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-02-05 10:31:06 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:37387: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-05 10:31:09 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:60213: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Feb  5 10:31:13 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  5 10:30:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-02-05 10:30:54 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:54197: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.65.117
description:
Feb  5 10:30:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.65.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Feb  5 10:31:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.55.136
description:
Feb  5 10:31:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.55.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
description:
Feb  5 10:30:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.55.136
description:
2025-02-05 10:31:07 dovecot_plain authenticator failed for ([120.237.55.136]) [120.237.55.136]:52790: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.216.56.106
description:
[2025-02-05 10:30:32 +0100] info [webmaild] 103.216.56.106 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
description:
2025-02-05 10:30:51 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:54894: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.37.65.42
description:
[2025-02-05 10:31:25 +0100] info [webmaild] 189.37.65.42 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Feb  5 10:30:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-02-05 10:31:07 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:25193: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Feb  5 10:31:09 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.55.59
description:
Feb  5 10:31:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.55.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-02-05 10:30:58 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:56518: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
description:
Feb  5 10:30:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Feb  5 10:31:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.156.254
description:
2025-02-05 10:31:24 dovecot_plain authenticator failed for mail.toptronicsinc.com [218.4.156.254]:54637: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
description:
2025-02-05 10:31:24 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:52514: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Feb  5 10:30:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
description:
Feb  5 10:30:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Feb  5 10:30:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Feb  5 10:30:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.128.108
description:
2025-02-05 10:30:55 dovecot_plain authenticator failed for ([39.129.128.108]) [39.129.128.108]:34756: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Feb  5 10:30:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-02-05 10:31:05 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:41515: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
description:
2025-02-05 10:31:06 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:52118: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.131.211.168
description:
2025-02-05 10:30:47 dovecot_plain authenticator failed for ([94.131.211.168]) [94.131.211.168]:50228: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.184.155
description:
Feb  5 10:30:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.184.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-02-05 10:31:01 dovecot_plain authenticator failed for ([121.175.8.140]) [121.175.8.140]:35980: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
description:
2025-02-05 10:30:54 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:56083: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.184.155
description:
2025-02-05 10:30:53 dovecot_plain authenticator failed for (mail.topkabel.com) [120.197.184.155]:55625: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.72.83.179
description:
Feb  5 10:31:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.72.83.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-02-05 10:31:15 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:48490: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
description:
Feb  5 10:31:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.131.211.168
description:
Feb  5 10:30:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.131.211.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.13.99.66
description:
Feb  5 10:30:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.13.99.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  5 10:31:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.107.198
description:
Feb  5 10:31:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.107.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 10:31:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.238.224.190
description:
Feb  5 10:31:19 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.238.224.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.238.224.190
description:
2025-02-05 10:31:21 dovecot_plain authenticator failed for ([115.238.224.190]) [115.238.224.190]:52196: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Feb  5 10:30:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
description:
Feb  5 10:30:57 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-02-05 10:31:11 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:56512: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-02-05 10:30:54 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:60840: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-02-05 10:30:59 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:30469: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.45.217.249
description:
Feb  5 10:30:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.45.217.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-02-05 10:31:11 dovecot_plain authenticator failed for (v2v92vanrokutcngbsv3z9i6xk) [77.40.62.195]:9420: 535 Incorrect authentication data (set_id=19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-02-05 10:30:41 dovecot_plain authenticator failed for (asime) [46.30.161.197]:37986: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-02-05 10:30:51 dovecot_plain authenticator failed for ([220.248.205.15]) [220.248.205.14]:1371: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Feb  5 10:31:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.27.252
description:
Feb  5 10:31:59 ait sshd[473892]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.27.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.40.19.68
description:
Feb  5 10:31:30 ait sshd[473694]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.40.19.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.211.97
description:
2025-02-05 10:31:46 dovecot_plain authenticator failed for (eqy3gdb8swqqx8b5nafqy1wk) [136.169.211.97]:35075: 535 Incorrect authentication data (set_id=19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 10:31:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.158.17.23
description:
[2025-02-05 10:31:58 +0100] info [webmaild] 146.158.17.23 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.27.252
description:
Feb  5 10:31:59 ait sshd[473892]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.27.252


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
description:
Feb  5 10:31:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-02-05 10:31:31 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:9525: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.86.198
description:
Feb  5 10:31:49 ait sshd[473857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.86.198


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.40.19.68
description:
Feb  5 10:31:30 ait sshd[473694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.40.19.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
description:
2025-02-05 10:31:30 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:51380: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.202.194.59
description:
[2025-02-05 10:33:18 +0100] info [webmaild] 187.202.194.59 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.216.157.178
description:
[2025-02-05 10:32:49 +0100] info [webmaild] 189.216.157.178 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.86.198
description:
Feb  5 10:32:53 ait sshd[474187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.86.198


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
description:
Feb  5 10:34:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
description:
2025-02-05 10:34:12 dovecot_login authenticator failed for ([182.135.66.179]) [182.135.66.179]:48262: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.70.203.114
description:
Feb  5 10:34:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.70.203.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.230
description:
Feb  5 10:34:18 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 10:33:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Feb  5 10:33:44 ait sshd[474498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
description:
2025-02-05 10:34:05 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:43163: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.70.203.114
description:
2025-02-05 10:34:20 dovecot_login authenticator failed for ([109.70.203.114]) [109.70.203.114]:42914: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Feb  5 10:33:44 ait sshd[474498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.150.62
description:
Feb  5 10:34:03 ait sshd[474563]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.209.150.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.230
description:
2025-02-05 10:34:20 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.230]:45330: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.209.150.62
description:
Feb  5 10:34:03 ait sshd[474563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.150.62


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
description:
Feb  5 10:34:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Feb  5 10:34:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.122.46.38
description:
[2025-02-05 10:35:06 +0100] info [webmaild] 103.122.46.38 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.40.19.68
description:
Feb  5 10:35:21 ait sshd[475051]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.40.19.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  5 10:34:35 ait sshd[474647]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  5 10:34:35 ait sshd[474647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
description:
2025-02-05 10:34:38 dovecot_plain authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:48414: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-02-05 10:34:48 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:57240: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-02-05 10:34:51 dovecot_plain authenticator failed for (unprooth) [109.166.70.166]:65464: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.40.19.68
description:
Feb  5 10:35:21 ait sshd[475051]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.40.19.68


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.66.149.207
description:
[2025-02-05 10:35:26 +0100] info [webmaild] 102.66.149.207 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.145.113.50
description:
[2025-02-05 10:34:30 +0100] info [webmaild] 103.145.113.50 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
description:
Feb  5 10:34:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Feb  5 10:34:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.176.50
description:
Feb  5 10:36:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.176.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.176.50
description:
2025-02-05 10:36:22 dovecot_plain authenticator failed for ([124.115.176.50]) [124.115.176.50]:54287: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.218.134.95
description:
Feb  5 10:36:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.218.134.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-02-05 10:35:57 dovecot_plain authenticator failed for (tablic) [93.159.152.6]:40702: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Feb  5 10:35:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.150.62
description:
Feb  5 10:36:16 ait sshd[475676]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.209.150.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.209.150.62
description:
Feb  5 10:36:16 ait sshd[475676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.150.62


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.6.212.57
description:
[2025-02-05 10:35:57 +0100] info [webmaild] 189.6.212.57 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.218.134.95
description:
2025-02-05 10:36:10 dovecot_plain authenticator failed for 32-218-134-95.bng02.trtn.ct.frontiernet.net [32.218.134.95]:52626: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.10.147
description:
[2025-02-05 10:37:07 +0100] info [webmaild] 177.84.10.147 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.40.19.68
description:
Feb  5 10:36:34 ait sshd[475725]: pam_imunify(sshd:auth): [IM360_RBL] The IP 74.40.19.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.40.19.68
description:
Feb  5 10:36:34 ait sshd[475725]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.40.19.68


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 74.40.19.68
description:
Feb  5 10:36:36 ait sshd[475725]: Failed password for invalid user test from 74.40.19.68 port 55818 ssh2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.36.191
description:
47.128.36.191 - - [05/Feb/2025:10:36:47 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6012691 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C61&filter_course-language=198%2C79&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.191


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.153.242
description:
[2025-02-05 10:38:02 +0100] info [webmaild] 168.205.153.242 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.209.150.62
description:
Feb  5 10:37:42 ait sshd[476142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 134.209.150.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 134.209.150.62
description:
Feb  5 10:37:42 ait sshd[476142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=134.209.150.62


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.160.179.230
description:
[2025-02-05 10:37:45 +0100] info [webmaild] 119.160.179.230 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 10:37:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-02-05 10:38:49 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:42768: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.96.129
description:
47.128.96.129 - - [05/Feb/2025:10:38:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11961303 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/10/?duration=short&filter_course-language=95&filtering=1&instructor=2&level=beginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.96.129


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.139.142
description:
2025-02-05 10:39:14 dovecot_plain authenticator failed for ([211.43.139.142]) [211.43.139.142]:34167: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.139.142
description:
Feb  5 10:39:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.139.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.221.252.41
description:
[2025-02-05 10:38:33 +0100] info [webmaild] 185.221.252.41 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 10:38:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Feb  5 10:38:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.55.95.22
description:
[2025-02-05 10:40:22 +0100] info [webmaild] 186.55.95.22 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Feb  5 10:39:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-02-05 10:39:41 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:44552: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
description:
Feb  5 10:39:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-02-05 10:40:01 dovecot_plain authenticator failed for ([196.191.212.236]) [213.55.85.202]:2879: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-05 10:39:55 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:43008: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
description:
2025-02-05 10:39:45 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:53795: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.33.99
description:
[2025-02-05 10:39:46 +0100] info [webmaild] 201.71.33.99 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Feb  5 10:39:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  5 10:39:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  5 10:40:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
description:
Feb  5 10:40:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
description:
2025-02-05 10:40:32 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:29583: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 10:40:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.187.146.68
description:
2025-02-05 10:40:43 dovecot_login authenticator failed for ([38.187.146.68]) [38.187.146.68]:51122: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.123.123
description:
[2025-02-05 10:41:14 +0100] info [webmaild] 179.0.123.123 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.187.146.68
description:
Feb  5 10:40:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.187.146.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.113.103.118
description:
[2025-02-05 10:40:42 +0100] info [webmaild] 190.113.103.118 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 10:40:59 ait sshd[477720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 10:40:59 ait sshd[477720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.220
description:
Feb  5 10:41:30 ait sshd[477815]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.220
description:
Feb  5 10:41:30 ait sshd[477815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.220  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.247.90.194
description:
Feb  5 10:41:40 ait sshd[477828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.247.90.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.247.90.194
description:
Feb  5 10:41:40 ait sshd[477828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.247.90.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.46.203.176
description:
Feb  5 10:42:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.46.203.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.46.203.176
description:
2025-02-05 10:42:34 dovecot_plain authenticator failed for ([211.46.203.176]) [211.46.203.176]:36509: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.138.0.19
description:
Feb  5 10:42:51 ait sshd[478329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.138.0.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Feb  5 10:42:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.57.98.34
description:
[2025-02-05 10:42:28 +0100] info [webmaild] 191.57.98.34 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.121.69
description:
Feb  5 10:43:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.121.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.177.34
description:
Feb  5 10:43:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.177.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.42.179
description:
[2025-02-05 10:43:21 +0100] info [webmaild] 158.181.42.179 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.228
description:
47.128.22.228 - - [05/Feb/2025:10:43:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15748837 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=183%2C79&instructor=2%2C1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.185.225.50
description:
Feb  5 10:42:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.185.225.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.185.225.50
description:
2025-02-05 10:42:58 dovecot_plain authenticator failed for ([220.185.225.50]) [220.185.225.50]:39724: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-02-05 10:42:58 dovecot_login authenticator failed for ([121.202.152.120]) [121.202.152.120]:37910: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.121.69
description:
2025-02-05 10:43:13 dovecot_login authenticator failed for ([183.238.121.69]) [183.238.121.69]:55671: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
description:
Feb  5 10:43:23 ait sshd[478399]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.138.0.19
description:
Feb  5 10:42:51 ait sshd[478329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.138.0.19 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.244.218.73
description:
[2025-02-05 10:43:03 +0100] info [webmaild] 170.244.218.73 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
description:
Feb  5 10:43:23 ait sshd[478399]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.60.133.41
description:
[2025-02-05 10:43:53 +0100] info [webmaild] 187.60.133.41 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-44.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.253.215.216
description:
[2025-02-05 10:45:05 +0100] info [webmaild] 38.253.215.216 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.138.0.19
description:
Feb  5 10:45:43 ait sshd[479226]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.138.0.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.78.119.104
description:
Feb  5 10:45:51 ait sshd[479387]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.78.119.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.55.116.66
description:
[2025-02-05 10:46:12 +0100] info [webmaild] 179.55.116.66 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Feb  5 10:46:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  5 10:45:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-05 10:45:32 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:41658: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.204
description:
Feb  5 10:45:40 ait sshd[479210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.204  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.224.180
description:
[2025-02-05 10:45:41 +0100] info [webmaild] 168.232.224.180 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-02-05 10:46:17 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:25208: 535 Incorrect authentication data (set_id=test@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
description:
2025-02-05 10:45:49 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:33671: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
description:
Feb  5 10:45:51 ait sshd[479387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.19.94
description:
2025-02-05 10:45:51 dovecot_plain authenticator failed for ([187.50.19.94]) [187.50.19.94]:59969: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
description:
2025-02-05 10:45:29 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:59361: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.65.51
description:
Feb  5 10:45:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.65.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  5 10:46:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
description:
Feb  5 10:45:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.204
description:
Feb  5 10:45:40 ait sshd[479210]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.138.0.19
description:
Feb  5 10:45:43 ait sshd[479226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.138.0.19


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.19.94
description:
Feb  5 10:45:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.19.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.150.115.44
description:
[2025-02-05 10:46:43 +0100] info [webmaild] 201.150.115.44 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
description:
Feb  5 10:47:13 ait sshd[480124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-05 10:46:27 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:29308: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
description:
Feb  5 10:46:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
description:
Feb  5 10:47:13 ait sshd[480124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.138.0.19
description:
Feb  5 10:47:06 ait sshd[480063]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.138.0.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.46.88.68
description:
2025-02-05 10:46:43 dovecot_plain authenticator failed for ([115.46.88.68]) [115.46.88.68]:48753: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.18.224
description:
2025-02-05 10:46:55 dovecot_plain authenticator failed for ([183.100.18.224]) [183.100.18.224]:53656: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-02-05 10:46:39 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:36009: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.138.0.19
description:
Feb  5 10:47:06 ait sshd[480063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.138.0.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
description:
2025-02-05 10:46:30 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:40906: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
description:
Feb  5 10:46:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
description:
2025-02-05 10:46:40 dovecot_plain authenticator failed for ([146.120.208.148]) [146.120.208.148]:59731: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.46.88.68
description:
Feb  5 10:46:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.46.88.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Feb  5 10:46:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-02-05 10:46:51 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:32941: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Feb  5 10:46:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 62.138.0.19
description:
Feb  5 10:47:08 ait sshd[480063]: Failed password for invalid user dev from 62.138.0.19 port 60008 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.18.224
description:
Feb  5 10:46:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.18.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.247.90.194
description:
Feb  5 10:47:39 ait sshd[480265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.247.90.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.247.90.194
description:
Feb  5 10:47:39 ait sshd[480265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.247.90.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 10:47:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.210.25.30
description:
[2025-02-05 10:47:53 +0100] info [webmaild] 102.210.25.30 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-02-05 10:49:00 dovecot_plain authenticator failed for (liophy) [89.175.253.49]:54654: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-02-05 10:49:05 dovecot_login authenticator failed for ([175.117.144.158]) [175.117.144.158]:49112: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 43.247.90.194
description:
Feb  5 10:48:28 ait sshd[480538]: Failed password for invalid user user from 43.247.90.194 port 51870 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Feb  5 10:48:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-02-05 10:48:44 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:23937: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.119.27.83
description:
[2025-02-05 10:49:12 +0100] info [webmaild] 188.119.27.83 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.237.83.130
description:
Feb  5 10:48:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.237.83.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.237.83.130
description:
2025-02-05 10:48:49 dovecot_login authenticator failed for ([23.237.83.130]) [23.237.83.130]:54592: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.245.186
description:
Feb  5 10:48:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.245.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Feb  5 10:48:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.188.136.188
description:
[2025-02-05 10:48:30 +0100] info [webmaild] 103.188.136.188 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.0.245.186
description:
2025-02-05 10:48:54 dovecot_plain authenticator failed for 131.0.245.186.core3.com.br [131.0.245.186]:44864: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Feb  5 10:49:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-02-05 10:50:09 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:60667: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Feb  5 10:50:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
description:
2025-02-05 10:49:33 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:58371: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-02-05 10:49:37 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:34100: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.217.89.32
description:
[2025-02-05 10:49:44 +0100] info [webmaild] 181.217.89.32 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
description:
Feb  5 10:49:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
description:
Feb  5 10:49:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
description:
Feb  5 10:49:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
description:
2025-02-05 10:49:48 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:44660: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-02-05 10:50:19 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:50322: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.153.152.233
description:
[2025-02-05 10:50:45 +0100] info [webmaild] 179.153.152.233 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.95.9
description:
2025-02-05 10:51:16 dovecot_plain authenticator failed for ([218.23.95.9]) [218.23.95.9]:32984: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.247.144
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-50.157.230.247.144


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 10:50:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.95.9
description:
Feb  5 10:51:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.95.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.133.24.220
description:
[2025-02-05 10:51:20 +0100] info [webmaild] 188.133.24.220 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 204.199.157.38
description:
[2025-02-05 10:52:23 +0100] info [webmaild] 204.199.157.38 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
description:
Feb  5 10:51:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
description:
2025-02-05 10:51:29 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:58984: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.212.179
description:
[2025-02-05 10:51:53 +0100] info [webmaild] 170.83.212.179 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.62.151.217
description:
[2025-02-05 10:53:25 +0100] info [webmaild] 189.62.151.217 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.95.146
description:
[2025-02-05 10:54:02 +0100] info [webmaild] 131.72.95.146 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Feb  5 10:54:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.43.18.192
description:
[2025-02-05 10:54:22 +0100] info [webmaild] 179.43.18.192 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-02-05 10:54:22 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:34680: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.54.49
description:
Feb  5 10:53:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.54.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.54.49
description:
2025-02-05 10:53:39 dovecot_plain authenticator failed for (58-115-54-49.twt1.com.tw) [58.115.54.49]:59415: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
description:
Feb  5 10:55:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.151.200.253
description:
Feb  5 10:55:09 ait sshd[483496]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.151.200.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-02-05 10:54:30 dovecot_login authenticator failed for ([1.28.87.38]) [1.28.87.38]:53489: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-02-05 10:55:02 dovecot_login authenticator failed for ([196.28.226.123]) [196.28.226.123]:49666: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.151.200.253
description:
Feb  5 10:55:09 ait sshd[483496]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.151.200.253


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Feb  5 10:54:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Feb  5 10:54:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.139.24.232
description:
[2025-02-05 10:54:54 +0100] info [webmaild] 177.139.24.232 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-02-05 10:54:33 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:45332: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
description:
2025-02-05 10:55:32 dovecot_login authenticator failed for ([50.217.255.171]) [50.217.255.171]:47847: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.151.200.253
description:
Feb  5 10:55:43 ait sshd[483683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.151.200.253 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.239
description:
47.128.47.239 - - [05/Feb/2025:10:56:00 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14030325 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=56&id=70&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
description:
Feb  5 10:55:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.18.55
description:
47.128.18.55 - - [05/Feb/2025:10:55:42 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14253147 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?duration=short&filter_course-language=118&filtering=1&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.18.55


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.151.200.253
description:
Feb  5 10:55:43 ait sshd[483683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.151.200.253


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.119.87.189
description:
[2025-02-05 10:56:08 +0100] info [webmaild] 201.119.87.189 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-02-05 10:56:53 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:45238: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.174.226
description:
Feb  5 10:57:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.174.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Feb  5 10:57:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-02-05 10:57:12 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:41415: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.145.209.247
description:
[2025-02-05 10:56:43 +0100] info [webmaild] 41.145.209.247 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Feb  5 10:56:51 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.212.116
description:
Feb  5 10:57:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.212.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.212.116
description:
2025-02-05 10:57:18 dovecot_plain authenticator failed for ([5.77.212.116]) [5.77.212.116]:41736: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
description:
Feb  5 10:56:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.174.226
description:
2025-02-05 10:57:05 dovecot_plain authenticator failed for ([58.216.174.226]) [58.216.174.226]:28062: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 10:57:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
description:
2025-02-05 10:56:55 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:42286: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.224.116
description:
[2025-02-05 10:57:00 +0100] info [webmaild] 37.40.224.116 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.208.180
description:
2025-02-05 10:58:07 H=(mail.ait-ext.com) [165.154.208.180]:59572 F=<vyjbknvxui@ait-ext.com> rejected RCPT <validxxxg@gmail.com>: Rejected relay attempt: '165.154.208.180' From: 'vyjbknvxui@ait-ext.com' To: 'validxxxg@gmail.com'


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.18.167
description:
[2025-02-05 10:57:31 +0100] info [webmaild] 177.36.18.167 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 10:57:41 ait sshd[484390]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 10:57:41 ait sshd[484390]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
description:
2025-02-05 10:59:13 dovecot_plain authenticator failed for ([123.139.116.184]) [123.139.116.184]:43742: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-02-05 10:59:26 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:36870: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.118.213.68
description:
Feb  5 10:59:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.118.213.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
description:
2025-02-05 10:59:02 dovecot_plain authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:37304: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 58.65.214.110
description:
[2025-02-05 10:59:21 +0100] info [webmaild] 58.65.214.110 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
description:
Feb  5 10:59:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
description:
Feb  5 10:59:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
description:
2025-02-05 10:59:18 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:39059: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
description:
2025-02-05 10:59:19 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:37898: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.159.140
description:
Feb  5 10:59:04 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.159.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-02-05 10:59:19 dovecot_plain authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:30600: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.159.140
description:
2025-02-05 10:59:06 dovecot_plain authenticator failed for (abts-north-dynamic-140.159.176.122.airtelbroadband.in) [122.176.159.140]:51588: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.19.241.245
description:
[2025-02-05 10:58:44 +0100] info [webmaild] 191.19.241.245 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
description:
2025-02-05 10:59:03 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:33970: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.199.165
description:
Feb  5 10:59:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
description:
Feb  5 10:59:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Feb  5 10:59:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
description:
2025-02-05 10:59:25 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:35124: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  5 10:58:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
description:
Feb  5 10:59:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-02-05 10:59:07 dovecot_plain authenticator failed for ([179.185.1.177]) [179.185.1.177]:36312: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.116.184
description:
Feb  5 10:59:11 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.116.184 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-59.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Feb  5 10:59:05 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
description:
Feb  5 11:00:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
description:
Feb  5 11:00:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
description:
2025-02-05 11:00:24 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:42394: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
description:
2025-02-05 11:00:24 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:59994: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
description:
Feb  5 11:00:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
description:
2025-02-05 11:00:27 dovecot_plain authenticator failed for ([221.0.111.113]) [221.0.111.113]:51399: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Feb  5 10:59:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.18.11.94
description:
2025-02-05 10:59:38 dovecot_plain authenticator failed for ([37.18.11.94]) [37.18.11.94]:36336: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
description:
Feb  5 11:00:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.154.146
description:
Feb  5 11:00:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.149.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
description:
Feb  5 11:00:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
description:
Feb  5 11:00:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Feb  5 11:00:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.49.61.211
description:
2025-02-05 11:00:26 dovecot_plain authenticator failed for ([136.49.61.211]) [136.49.61.211]:57706: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.18.11.94
description:
Feb  5 10:59:36 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.18.11.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.186.56.195
description:
[2025-02-05 11:00:09 +0100] info [webmaild] 182.186.56.195 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.175
description:
Feb  5 11:00:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
description:
Feb  5 11:00:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
description:
Feb  5 11:00:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
description:
2025-02-05 11:00:26 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:40887: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-05 11:00:25 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:59142: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
description:
Feb  5 11:00:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
description:
Feb  5 11:00:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.167.59
description:
Feb  5 11:00:26 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.167.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.33.109.90
description:
Feb  5 11:00:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.33.109.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-02-05 10:59:34 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:38242: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
description:
Feb  5 11:00:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.164.171.122
description:
[2025-02-05 11:00:26 +0100] info [webmaild] 102.164.171.122 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-05 11:00:27 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:37978: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  5 11:00:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-02-05 11:00:27 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:40784: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
description:
Feb  5 11:00:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
description:
2025-02-05 11:00:24 dovecot_plain authenticator failed for ([92.62.243.175]) [92.62.243.175]:35602: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-05 11:00:24 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:38497: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.149.154.146
description:
2025-02-05 11:00:25 dovecot_plain authenticator failed for ([103.149.154.146]) [103.149.154.146]:49709: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-02-05 11:00:25 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:54750: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
description:
2025-02-05 11:00:25 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:39978: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
description:
2025-02-05 11:00:26 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:33567: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.24.138.130
description:
Feb  5 11:00:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.24.138.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.212.136.240
description:
Feb  5 11:00:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.212.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.49.61.211
description:
Feb  5 11:00:24 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.49.61.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Feb  5 11:00:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.136.240
description:
2025-02-05 11:00:26 dovecot_plain authenticator failed for 240.sub-97-212-136.myvzw.com [97.212.136.240]:50722: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.24.138.130
description:
2025-02-05 11:00:26 dovecot_plain authenticator failed for syn-024-024-138-130.res.spectrum.com [24.24.138.130]:58202: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
description:
2025-02-05 11:00:27 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:35931: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  5 11:00:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  5 11:00:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Feb  5 11:00:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
description:
2025-02-05 11:00:28 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:33404: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-02-05 11:00:29 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:26620: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.209.141
description:
2025-02-05 11:00:29 dovecot_plain authenticator failed for 141.sub-166-169-209.myvzw.com [166.169.209.141]:63495: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-02-05 11:00:30 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:55714: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Feb  5 11:00:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.140.107.227
description:
Feb  5 11:01:00 ait sshd[485837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.140.107.227  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Feb  5 11:00:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-02-05 11:00:33 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:40130: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
description:
Feb  5 11:00:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-02-05 11:00:42 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:41640: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-02-05 11:01:02 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:33346: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.131
description:
2025-02-05 11:00:32 dovecot_plain authenticator failed for ([27.40.100.131]) [27.40.100.131]:45988: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.84.175
description:
2025-02-05 11:00:34 dovecot_plain authenticator failed for ([222.114.84.175]) [222.114.84.175]:51590: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
description:
2025-02-05 11:00:38 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:33841: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
description:
Feb  5 11:00:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-02-05 11:00:48 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:33206: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-02-05 11:00:58 dovecot_plain authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:54780: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.140.107.227
description:
Feb  5 11:01:00 ait sshd[485837]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.140.107.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
description:
2025-02-05 11:01:14 dovecot_plain authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:43113: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  5 11:00:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.69.195.7
description:
2025-02-05 11:00:30 dovecot_plain authenticator failed for ([125.69.195.7]) [125.69.195.7]:38074: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Feb  5 11:00:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
description:
2025-02-05 11:00:43 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:45338: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Feb  5 11:00:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-02-05 11:00:51 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:52830: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-02-05 11:00:54 dovecot_plain authenticator failed for ([103.251.143.14]) [103.251.143.14]:56098: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.140.212.144
description:
Feb  5 11:01:03 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.140.212.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Feb  5 11:00:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
description:
2025-02-05 11:00:48 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:34786: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.45.225.98
description:
Feb  5 11:00:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.45.225.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
description:
2025-02-05 11:00:36 dovecot_plain authenticator failed for ([50.201.37.210]) [50.201.37.210]:59037: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-02-05 11:00:37 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:59501: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Feb  5 11:00:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-02-05 11:00:40 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:23728: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
description:
2025-02-05 11:00:41 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:57778: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  5 11:00:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Feb  5 11:00:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.122.213
description:
Feb  5 11:00:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.122.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Feb  5 11:00:40 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Feb  5 11:00:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
description:
Feb  5 11:00:52 ait sshd[485831]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
description:
Feb  5 11:00:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-05 11:00:48 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:42834: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.94.151
description:
Feb  5 11:01:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.94.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.246.138.100
description:
Feb  5 11:00:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.246.138.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.94.151
description:
2025-02-05 11:01:12 dovecot_plain authenticator failed for ([211.252.94.151]) [211.252.94.151]:57930: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.69.195.7
description:
Feb  5 11:00:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.69.195.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.69.31.50
description:
Feb  5 11:00:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.69.31.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-02-05 11:00:42 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:45180: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-02-05 11:00:50 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:50796: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.140.212.144
description:
2025-02-05 11:01:05 dovecot_plain authenticator failed for ([5.140.212.144]) [5.140.212.144]:38170: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
description:
2025-02-05 11:00:28 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:59658: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-05 11:00:29 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:64190: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
description:
Feb  5 11:00:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.131
description:
Feb  5 11:00:30 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
description:
2025-02-05 11:00:36 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:36750: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-05 11:00:40 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:36879: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Feb  5 11:00:45 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.241
description:
2025-02-05 11:00:52 dovecot_plain authenticator failed for (mobile-166-195-196-241.mycingular.net) [166.195.196.241]:55758: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Feb  5 11:00:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-02-05 11:00:39 dovecot_plain authenticator failed for ([60.167.19.30]) [60.167.19.30]:35102: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.26.106
description:
2025-02-05 11:00:43 dovecot_plain authenticator failed for ([58.240.26.106]) [58.240.26.106]:61889: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
description:
2025-02-05 11:00:46 dovecot_plain authenticator failed for (201.172.170.49-clientes-izzi.mx) [201.172.170.49]:50903: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Feb  5 11:01:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
description:
Feb  5 11:00:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
description:
2025-02-05 11:00:34 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:62511: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Feb  5 11:00:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
description:
2025-02-05 11:00:31 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:52136: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.30
description:
2025-02-05 11:00:31 dovecot_plain authenticator failed for ([110.35.63.30]) [110.35.63.30]:49946: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-02-05 11:00:39 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:57227: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Feb  5 11:00:48 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
description:
2025-02-05 11:00:37 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:54108: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
description:
2025-02-05 11:00:43 dovecot_plain authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:48153: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-02-05 11:00:51 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:45224: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
description:
Feb  5 11:00:55 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.91.96.58
description:
Feb  5 11:00:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.91.96.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
description:
Feb  5 11:00:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-02-05 11:00:44 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:59962: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
description:
2025-02-05 11:00:51 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:41228: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.57.10
description:
Feb  5 11:00:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.57.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Feb  5 11:00:42 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
description:
Feb  5 11:01:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
description:
2025-02-05 11:00:28 dovecot_plain authenticator failed for ([111.39.167.59]) [111.39.167.59]:37724: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Feb  5 11:00:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.241
description:
Feb  5 11:00:50 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.84.175
description:
Feb  5 11:00:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.84.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.31.50
description:
2025-02-05 11:00:35 dovecot_plain authenticator failed for ([109.69.31.50]) [109.69.31.50]:54954: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
description:
Feb  5 11:00:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-02-05 11:00:47 dovecot_plain authenticator failed for ([123.142.230.50]) [123.142.230.50]:53326: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-02-05 11:01:00 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:11799: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.209.141
description:
Feb  5 11:00:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.209.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-02-05 11:00:28 dovecot_plain authenticator failed for ([216.194.174.86]) [216.194.174.27]:58989: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-02-05 11:00:40 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:57733: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-02-05 11:00:45 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:42238: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
description:
Feb  5 11:00:28 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
description:
2025-02-05 11:00:29 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:53692: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.170.76
description:
Feb  5 11:00:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.170.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
description:
Feb  5 11:00:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Feb  5 11:00:34 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.58.173
description:
Feb  5 11:00:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.58.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.196.92
description:
2025-02-05 11:01:14 dovecot_plain authenticator failed for (223-197-196-92.static.imsbiz.com) [223.197.196.92]:58989: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.178
description:
2025-02-05 11:01:25 dovecot_login authenticator failed for 95-210-105-178.ip.skylogicnet.com [95.210.105.178]:41004: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.236.91.93
description:
Feb  5 11:00:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.236.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Feb  5 11:00:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-02-05 11:00:36 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:44052: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.26.106
description:
Feb  5 11:00:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.26.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
description:
2025-02-05 11:00:29 dovecot_plain authenticator failed for (90.109.33.58.broad.xw.sh.dynamic.163data.com.cn) [58.33.109.90]:33440: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.30
description:
Feb  5 11:00:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.91.96.58
description:
2025-02-05 11:00:41 dovecot_plain authenticator failed for ([222.91.96.58]) [222.91.96.58]:49397: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
description:
2025-02-05 11:00:55 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:56220: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
description:
Feb  5 11:00:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-02-05 11:00:34 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:46364: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-02-05 11:00:35 dovecot_plain authenticator failed for ([188.227.66.92]) [188.227.66.92]:51884: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-02-05 11:00:29 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:48026: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.236.91.93
description:
2025-02-05 11:00:33 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [42.236.91.93]:4014: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.76
description:
2025-02-05 11:00:36 dovecot_plain authenticator failed for ([218.149.170.76]) [218.149.170.76]:48601: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.10.50
description:
Feb  5 11:00:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.10.50 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
description:
Feb  5 11:00:52 ait sshd[485831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Feb  5 11:00:56 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
description:
Feb  5 11:00:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.45.225.98
description:
2025-02-05 11:00:37 dovecot_plain authenticator failed for ([69.45.225.98]) [69.45.225.98]:32922: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
description:
2025-02-05 11:00:37 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:53989: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.10.50
description:
2025-02-05 11:00:40 dovecot_plain authenticator failed for 111-70-10-50.emome-ip.hinet.net [111.70.10.50]:33171: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.58.173
description:
2025-02-05 11:00:46 dovecot_plain authenticator failed for ([192.199.58.173]) [192.199.58.173]:34856: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.246.138.100
description:
2025-02-05 11:00:58 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:57166: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
description:
2025-02-05 11:00:28 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:59930: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Feb  5 11:00:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Feb  5 11:00:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-02-05 11:00:36 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:54873: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
description:
Feb  5 11:00:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
description:
2025-02-05 11:00:57 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:57406: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.196.92
description:
Feb  5 11:01:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.196.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-02-05 11:00:29 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:46622: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Feb  5 11:00:33 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  5 11:00:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Feb  5 11:00:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Feb  5 11:00:46 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Feb  5 11:00:49 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-05 11:02:09 dovecot_plain authenticator failed for (unmenon) [81.211.77.58]:15526: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Feb  5 11:01:41 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.249
description:
Feb  5 11:01:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.249 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.158.60.0
description:
[2025-02-05 11:01:35 +0100] info [webmaild] 94.158.60.0 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-02-05 11:01:43 dovecot_plain authenticator failed for (pnous) [149.0.16.4]:41550: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-02-05 11:01:56 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:36682: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  5 11:02:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.140.107.227
description:
Feb  5 11:01:28 ait sshd[486056]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.140.107.227 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.140.107.227
description:
Feb  5 11:01:28 ait sshd[486056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.140.107.227  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Feb  5 11:01:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.205.59.154
description:
[2025-02-05 11:02:09 +0100] info [webmaild] 156.205.59.154 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.249
description:
2025-02-05 11:01:45 dovecot_login authenticator failed for ([104.241.233.249]) [104.241.233.249]:33062: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.175
description:
Feb  5 11:03:18 ait sshd[487029]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.208.156.175 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.208.156.175
description:
Feb  5 11:03:18 ait sshd[487029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.208.156.175


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Feb  5 11:03:21 ait sshd[487041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.181.16.29
description:
[2025-02-05 11:03:00 +0100] info [webmaild] 187.181.16.29 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Feb  5 11:03:21 ait sshd[487041]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  5 11:03:02 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Feb  5 11:04:21 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-02-05 11:04:22 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:41737: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  5 11:03:25 ait sshd[487057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
description:
Feb  5 11:04:01 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
description:
2025-02-05 11:04:02 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:33574: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.157.134
description:
Feb  5 11:04:16 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.157.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Feb  5 11:04:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
description:
2025-02-05 11:04:17 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:34392: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-02-05 11:04:23 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:43336: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
description:
Feb  5 11:04:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Feb  5 11:04:15 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.63.233.217
description:
[2025-02-05 11:04:17 +0100] info [webmaild] 187.63.233.217 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.157.134
description:
2025-02-05 11:04:18 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.157.134]:37804: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Feb  5 11:04:20 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  5 11:03:25 ait sshd[487057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.121.58.3
description:
[2025-02-05 11:03:30 +0100] info [webmaild] 138.121.58.3 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
description:
2025-02-05 11:04:03 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:48555: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
description:
Feb  5 11:04:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
description:
2025-02-05 11:04:19 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:50228: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
description:
2025-02-05 11:04:19 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:55190: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.136
description:
[2025-02-05 11:04:34 +0100] info [whostmgrd] 156.228.94.136 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
description:
2025-02-05 11:04:37 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:53804: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
description:
Feb  5 11:04:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.48.223
description:
[2025-02-05 11:04:45 +0100] info [whostmgrd] 104.207.48.223 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.62.174
description:
[2025-02-05 11:04:32 +0100] info [cpaneld] 104.207.62.174 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.55.229
description:
[2025-02-05 11:04:50 +0100] info [whostmgrd] 104.207.55.229 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.25.136
description:
[2025-02-05 11:04:52 +0100] info [webmaild] 45.224.25.136 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
description:
Feb  5 11:04:35 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.181
description:
[2025-02-05 11:04:42 +0100] info [cpaneld] 156.228.90.181 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.92.126
description:
[2025-02-05 11:04:35 +0100] info [whostmgrd] 156.228.92.126 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.117
description:
[2025-02-05 11:04:40 +0100] info [cpaneld] 156.228.93.117 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.108
description:
2025-02-05 11:04:41 dovecot_login authenticator failed for ([112.91.124.108]) [112.91.124.108]:53492: 535 Incorrect authentication data (set_id=nkansah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.201
description:
[2025-02-05 11:04:43 +0100] info [cpaneld] 104.207.38.201 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.46.92
description:
[2025-02-05 11:04:47 +0100] info [whostmgrd] 104.207.46.92 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.151
description:
[2025-02-05 11:04:30 +0100] info [cpaneld] 156.228.90.151 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.203
description:
[2025-02-05 11:04:35 +0100] info [cpaneld] 156.228.105.203 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
description:
2025-02-05 11:04:46 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:64259: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-02-05 11:04:31 dovecot_login authenticator failed for ([43.154.94.85]) [43.154.94.85]:44406: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.98.136
description:
[2025-02-05 11:04:45 +0100] info [whostmgrd] 156.228.98.136 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.82.210
description:
[2025-02-05 11:04:40 +0100] info [whostmgrd] 156.228.82.210 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
description:
2025-02-05 11:04:40 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:51918: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.185
description:
[2025-02-05 11:04:35 +0100] info [whostmgrd] 104.207.58.185 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.43.36
description:
[2025-02-05 11:04:41 +0100] info [whostmgrd] 104.207.43.36 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.218
description:
[2025-02-05 11:04:44 +0100] info [whostmgrd] 104.207.52.218 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.94.210
description:
[2025-02-05 11:04:48 +0100] info [whostmgrd] 156.228.94.210 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
description:
Feb  5 11:04:50 ait sshd[487621]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.58
description:
[2025-02-05 11:04:50 +0100] info [whostmgrd] 156.228.119.58 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
description:
Feb  5 11:04:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.108
description:
[2025-02-05 11:04:29 +0100] info [cpaneld] 156.228.109.108 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.35
description:
[2025-02-05 11:04:42 +0100] info [cpaneld] 156.228.95.35 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.113.101
description:
[2025-02-05 11:04:49 +0100] info [whostmgrd] 156.228.113.101 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Feb  5 11:05:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
description:
Feb  5 11:04:38 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.46.241
description:
[2025-02-05 11:04:46 +0100] info [whostmgrd] 104.207.46.241 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.125
description:
[2025-02-05 11:04:38 +0100] info [cpaneld] 156.228.106.125 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.62.118
description:
[2025-02-05 11:04:44 +0100] info [whostmgrd] 104.207.62.118 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.107
description:
[2025-02-05 11:04:31 +0100] info [cpaneld] 104.207.52.107 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.124
description:
[2025-02-05 11:04:41 +0100] info [cpaneld] 104.207.56.124 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.48
description:
[2025-02-05 11:04:33 +0100] info [cpaneld] 156.228.90.48 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user awadzie (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.255
description:
[2025-02-05 11:04:36 +0100] info [whostmgrd] 104.207.60.255 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.95.206
description:
[2025-02-05 11:04:38 +0100] info [cpaneld] 156.228.95.206 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.131
description:
[2025-02-05 11:04:43 +0100] info [whostmgrd] 104.207.39.131 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
description:
Feb  5 11:04:50 ait sshd[487621]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.33.194
description:
[2025-02-05 11:04:40 +0100] info [cpaneld] 104.207.33.194 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-02-05 11:05:09 dovecot_plain authenticator failed for ([116.113.254.26]) [116.113.254.26]:49048: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.14
description:
[2025-02-05 11:04:39 +0100] info [cpaneld] 156.228.93.14 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.108
description:
Feb  5 11:04:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.185
description:
[2025-02-05 11:04:44 +0100] info [whostmgrd] 104.207.59.185 - awadzie "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Feb  5 11:05:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Feb  5 11:06:08 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
description:
2025-02-05 11:06:24 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:56790: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-02-05 11:05:54 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:43721: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Feb  5 11:06:10 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.53.187
description:
Feb  5 11:06:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.53.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  5 11:05:43 ait sshd[488140]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  5 11:05:43 ait sshd[488140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.229.134
description:
[2025-02-05 11:05:58 +0100] info [webmaild] 38.156.229.134 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-02-05 11:06:10 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:46601: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.140.237.157
description:
[2025-02-05 11:06:14 +0100] info [webmaild] 201.140.237.157 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-02-05 11:06:12 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:34444: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-05 11:05:45 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:47840: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Feb  5 11:05:52 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-02-05 11:06:49 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:49556: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Feb  5 11:06:59 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-02-05 11:07:25 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (enite) [81.225.30.107]:35837: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.84.220
description:
Feb  5 11:06:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.84.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.84.220
description:
2025-02-05 11:06:29 dovecot_plain authenticator failed for ([175.210.84.220]) [175.210.84.220]:53502: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.125.119.121
description:
[2025-02-05 11:06:46 +0100] info [webmaild] 154.125.119.121 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-02-05 11:07:01 dovecot_plain authenticator failed for ([121.202.154.25]) [121.202.154.25]:49789: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-02-05 11:07:24 dovecot_login authenticator failed for ([222.160.227.134]) [222.160.227.134]:54112: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Feb  5 11:07:23 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-02-05 11:07:02 dovecot_plain authenticator failed for (anshom) [102.53.15.18]:40923: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Feb  5 11:07:12 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
description:
Feb  5 11:06:28 ait sshd[488410]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-02-05 11:06:34 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:57414: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Feb  5 11:06:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Feb  5 11:07:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Feb  5 11:06:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-02-05 11:07:14 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:48851: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-02-05 11:07:00 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:53950: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.244
description:
Feb  5 11:07:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.244 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  5 11:06:28 ait sshd[488410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-02-05 11:06:39 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:55406: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-02-05 11:07:08 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:40624: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Feb  5 11:06:37 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Feb  5 11:06:47 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.244
description:
2025-02-05 11:07:16 dovecot_plain authenticator failed for (nsg-corporate-244.229.187.122.airtel.in) [122.187.229.244]:35122: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Feb  5 11:07:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.154.71.2
description:
[2025-02-05 11:07:23 +0100] info [webmaild] 85.154.71.2 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-02-05 11:07:41 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:45692: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.100
description:
Feb  5 11:07:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Feb  5 11:07:29 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-02-05 11:07:31 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:49884: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Feb  5 11:07:39 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.100
description:
2025-02-05 11:07:45 dovecot_login authenticator failed for (m121-202-203-100.smartone.com) [121.202.203.100]:14953: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.113.247.191
description:
[2025-02-05 11:08:28 +0100] info [webmaild] 189.113.247.191 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  5 11:08:29 ait sshd[489135]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Feb  5 11:08:54 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-02-05 11:08:56 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (winds) [87.103.126.54]:45052: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.186.106.241
description:
[2025-02-05 11:08:58 +0100] info [webmaild] 138.186.106.241 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.6.18.86
description:
[2025-02-05 11:09:21 +0100] info [webmaild] 189.6.18.86 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  5 11:08:29 ait sshd[489135]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
description:
Feb  5 11:09:17 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
description:
2025-02-05 11:09:19 dovecot_plain authenticator failed for ([110.14.192.20]) [110.14.192.20]:47940: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.247
description:
2025-02-05 11:09:29 dovecot_plain authenticator failed for (nsg-corporate-247.229.187.122.airtel.in) [122.187.229.247]:52106: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.90.252
description:
Feb  5 11:09:43 ait sshd[489679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.90.252


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.45.245.35
description:
Feb  5 11:09:52 ait sshd[489711]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.45.245.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.45.245.35
description:
Feb  5 11:09:52 ait sshd[489711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.45.245.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.247
description:
Feb  5 11:09:27 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.128.90.252
description:
Feb  5 11:09:43 ait sshd[489679]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.128.90.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.240.185.218
description:
[2025-02-05 11:09:56 +0100] info [webmaild] 186.240.185.218 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
description:
Feb  5 11:11:06 ait sshd[490492]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
description:
Feb  5 11:11:06 ait sshd[490492]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  5 11:10:31 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.250.238.189
description:
Feb  5 11:10:44 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.250.238.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.250.238.189
description:
2025-02-05 11:10:46 dovecot_plain authenticator failed for c83-250-238-189.bredband.tele2.se (reessel) [83.250.238.189]:59836: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.121.25.155
description:
[2025-02-05 11:11:20 +0100] info [webmaild] 178.121.25.155 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
description:
Feb  5 11:11:53 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
description:
2025-02-05 11:11:55 dovecot_plain authenticator failed for ([158.140.38.21]) [158.140.38.21]:54613: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.156.240
description:
[2025-02-05 11:12:10 +0100] info [webmaild] 138.204.156.240 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 11:11:26 ait sshd[490658]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 11:11:26 ait sshd[490658]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.48.98.125
description:
Feb  5 11:11:27 ait sshd[490654]: Failed password for invalid user asha from 120.48.98.125 port 48530 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.78.228.177
description:
[2025-02-05 11:12:26 +0100] info [webmaild] 170.78.228.177 - noreply@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  5 11:11:43 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Feb  5 11:12:14 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-02-05 11:12:16 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:39756: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
description:
Feb  5 11:12:25 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
description:
Feb  5 11:11:25 ait sshd[490654]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-05 11:11:45 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:37490: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.154.70.255
description:
[2025-02-05 11:11:52 +0100] info [webmaild] 85.154.70.255 - noreply@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  5 11:11:25 ait sshd[490654]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
description:
2025-02-05 11:12:27 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:38100: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Feb  5 11:13:00 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-02-05 11:13:02 dovecot_login authenticator failed for ([110.226.126.143]) [103.250.149.90]:49084: 535 Incorrect authentication data (set_id=swanzy@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-02-05 11:13:09 dovecot_login authenticator failed for ([78.142.41.167]) [78.142.41.167]:45756: 535 Incorrect authentication data (set_id=swanzy)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  5 11:13:22 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-05 11:13:24 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:57138: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.10.53.109
description:
Feb  5 11:12:35 ait sshd[491229]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.10.53.109  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.213
description:
Feb  5 11:12:57 ait sshd[491307]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.213
description:
Feb  5 11:12:57 ait sshd[491307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.213  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.195.145.39
description:
[2025-02-05 11:12:39 +0100] info [webmaild] 156.195.145.39 - noreply@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Feb  5 11:13:07 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.10.53.109
description:
Feb  5 11:12:35 ait sshd[491229]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.10.53.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  5 11:13:59 ait sshd[491723]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.80.2.77
description:
[2025-02-05 11:14:01 +0100] info [webmaild] 103.80.2.77 - noreply@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
description:
2025-02-05 11:13:34 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:54264: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  5 11:13:53 ait sshd[491683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  5 11:13:59 ait sshd[491723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-14.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
description:
Feb  5 11:13:32 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  5 11:13:53 ait sshd[491683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.99
description:
Feb  5 11:14:58 ait auth[392352]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.99 has been locked due to Imunify RBL


