# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
country_id: 2017370
description:
2025-02-06 02:42:01 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:38051: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.68.194.54
country_id: 1835841
description:
Feb  6 02:42:11 ait sshd[932003]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.68.194.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
country_id: 290557
description:
Feb  6 02:41:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
country_id: 2921044
description:
Feb  6 02:41:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
country_id: 2017370
description:
Feb  6 02:41:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.68.194.54
country_id: 1835841
description:
Feb  6 02:42:11 ait sshd[932003]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.68.194.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
country_id: 1814991
description:
Feb  6 02:41:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
country_id: 1814991
description:
2025-02-06 02:41:44 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:54951: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.192.20.166
country_id: 3175395
description:
2025-02-06 02:41:38 dovecot_plain authenticator failed for ([2.192.20.166]) [2.192.20.166]:33810: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-02-06 02:41:41 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:34868: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-02-06 02:41:57 dovecot_plain authenticator failed for (ruity) [102.53.15.56]:58932: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
country_id: 1835841
description:
2025-02-06 02:41:36 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:43320: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
country_id: 2921044
description:
2025-02-06 02:41:46 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:56062: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.25.179
country_id: 3469034
description:
[2025-02-06 02:41:57 +0100] info [webmaild] 177.22.25.179 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-02-06 02:43:08 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:47777: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
country_id: 1269750
description:
Feb  6 02:42:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.109.37
country_id: 1210997
description:
Feb  6 02:42:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
country_id: 6252001
description:
2025-02-06 02:42:54 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:35595: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
country_id: 1269750
description:
Feb  6 02:42:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
country_id: 458258
description:
2025-02-06 02:42:59 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:58584: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 02:43:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
country_id: 3017382
description:
2025-02-06 02:43:16 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:33516: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
country_id: 6252001
description:
2025-02-06 02:43:16 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:59248: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
country_id: 1210997
description:
2025-02-06 02:42:54 dovecot_plain authenticator failed for ([103.245.109.37]) [103.245.109.37]:56924: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
country_id: 1814991
description:
2025-02-06 02:42:55 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:57441: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.57.10
country_id: 1643084
description:
Feb  6 02:42:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.57.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
country_id: 1643084
description:
2025-02-06 02:43:00 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:60692: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
country_id: 2077456
description:
Feb  6 02:43:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2025-02-06 02:42:54 dovecot_plain authenticator failed for ([116.114.94.242]) [116.114.94.242]:47522: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
country_id: 1835841
description:
2025-02-06 02:43:06 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:37510: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Feb  6 02:43:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-06 02:42:59 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:60493: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2025-02-06 02:42:59 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:53281: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 02:43:09 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:39646: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 02:42:46 ait sshd[932075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.240.121.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.214.147
country_id: 2750405
description:
2025-02-06 02:42:52 dovecot_plain authenticator failed for host-ys.srk1-b.v4.dfn.nl [62.238.214.147]:37894: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
country_id: 2017370
description:
Feb  6 02:42:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
country_id: 2077456
description:
Feb  6 02:42:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
country_id: 1835841
description:
Feb  6 02:42:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
country_id: 294640
description:
2025-02-06 02:43:12 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:26329: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
country_id: 337996
description:
Feb  6 02:43:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
country_id: 2017370
description:
Feb  6 02:43:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 02:42:46 ait sshd[932075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.240.121.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.18.217
country_id: 1814991
description:
2025-02-06 02:42:58 dovecot_plain authenticator failed for ([117.175.18.217]) [117.175.18.217]:41411: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
country_id: 1819730
description:
Feb  6 02:43:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
country_id: 2017370
description:
Feb  6 02:43:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
country_id: 2661886
description:
Feb  6 02:43:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
country_id: 1819730
description:
2025-02-06 02:43:02 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:19858: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  6 02:43:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
country_id: 294640
description:
Feb  6 02:43:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
country_id: 2017370
description:
Feb  6 02:42:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
country_id: 2017370
description:
2025-02-06 02:42:52 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:53792: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
country_id: 6252001
description:
Feb  6 02:42:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
country_id: 3469034
description:
2025-02-06 02:42:57 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:49506: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
country_id: 1861060
description:
Feb  6 02:42:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.196
country_id: 6252001
description:
2025-02-06 02:43:19 dovecot_plain authenticator failed for ([76.77.25.196]) [76.77.25.196]:52511: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-02-06 02:43:17 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:34292: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
country_id: 3175395
description:
Feb  6 02:42:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
country_id: 3175395
description:
2025-02-06 02:42:52 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:36982: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
country_id: 1814991
description:
Feb  6 02:42:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
country_id: 3469034
description:
2025-02-06 02:42:57 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:43445: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.202
country_id: 1269750
description:
2025-02-06 02:43:18 dovecot_plain authenticator failed for ([103.146.233.202]) [103.146.233.202]:44237: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.12
country_id: 1269750
description:
Feb  6 02:43:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
country_id: 3469034
description:
Feb  6 02:42:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.238
country_id: 337996
description:
Feb  6 02:42:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-02-06 02:42:51 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:53221: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
country_id: 1835841
description:
2025-02-06 02:42:58 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:49164: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.171
country_id: 1668284
description:
Feb  6 02:43:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 02:43:11 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:55366: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
country_id: 6252001
description:
Feb  6 02:42:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2025-02-06 02:42:55 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:35911: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.250
country_id: 1814991
description:
Feb  6 02:43:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
country_id: 6252001
description:
Feb  6 02:43:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-06 02:43:15 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:47488: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.248.47.114
country_id: 6252001
description:
2025-02-06 02:42:54 dovecot_plain authenticator failed for syn-172-248-047-114.res.spectrum.com [172.248.47.114]:48372: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
country_id: 1835841
description:
Feb  6 02:42:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
country_id: 1835841
description:
Feb  6 02:43:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
country_id: 337996
description:
Feb  6 02:43:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
country_id: 1819730
description:
2025-02-06 02:43:07 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:33572: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
country_id: 6252001
description:
Feb  6 02:42:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.224.181.132
country_id: 3469034
description:
[2025-02-06 02:43:10 +0100] info [webmaild] 38.224.181.132 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
country_id: 6252001
description:
2025-02-06 02:43:19 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:53936: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
country_id: 1269750
description:
2025-02-06 02:42:57 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:59656: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.76
country_id: 1668284
description:
2025-02-06 02:43:11 dovecot_plain authenticator failed for 111-70-39-76.emome-ip.hinet.net [111.70.39.76]:51165: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  6 02:43:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.39.76
country_id: 1668284
description:
Feb  6 02:43:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.18.126.17
country_id: 2510769
description:
Feb  6 02:42:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.18.126.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.248.47.114
country_id: 6252001
description:
Feb  6 02:42:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.248.47.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.78.83.78
country_id: 1269750
description:
Feb  6 02:42:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.78.83.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
country_id: 1814991
description:
Feb  6 02:43:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
country_id: 3017382
description:
Feb  6 02:43:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.12
country_id: 1269750
description:
2025-02-06 02:43:28 dovecot_plain authenticator failed for (nsg-corporate-12.229.187.122.airtel.in) [122.187.229.12]:50543: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2025-02-06 02:42:51 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:59556: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.18.126.17
country_id: 2510769
description:
2025-02-06 02:42:51 dovecot_plain authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:51297: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 02:42:58 ait sshd[932241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.149
country_id: 3996063
description:
2025-02-06 02:43:08 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.149]:59570: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-02-06 02:43:14 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:39790: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2025-02-06 02:43:19 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:37933: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.94.199.168
country_id: 3469034
description:
[2025-02-06 02:42:39 +0100] info [webmaild] 138.94.199.168 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
country_id: 1814991
description:
Feb  6 02:42:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
country_id: 2017370
description:
Feb  6 02:42:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
country_id: 2400553
description:
Feb  6 02:43:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
country_id: 6252001
description:
Feb  6 02:43:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  6 02:43:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.30.217.31
country_id: 2017370
description:
Feb  6 02:42:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.30.217.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
country_id: 2017370
description:
2025-02-06 02:43:08 dovecot_plain authenticator failed for ([146.120.208.148]) [146.120.208.148]:59404: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
country_id: 2077456
description:
2025-02-06 02:43:09 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:57364: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.202
country_id: 1269750
description:
Feb  6 02:43:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 02:43:11 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:49892: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
country_id: 1835841
description:
Feb  6 02:43:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
country_id: 617790
description:
2025-02-06 02:43:20 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:46916: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  6 02:43:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-06 02:43:22 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:44965: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.236.91.93
country_id: 1814991
description:
Feb  6 02:43:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.236.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
country_id: 2029969
description:
Feb  6 02:43:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.135.254
country_id: 1814991
description:
Feb  6 02:43:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.135.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
country_id: 2077456
description:
2025-02-06 02:43:07 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:42090: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
country_id: 1835841
description:
2025-02-06 02:42:55 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:36112: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.34
country_id: 617790
description:
Feb  6 02:43:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
country_id: 2017370
description:
2025-02-06 02:43:06 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:52538: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
country_id: 1814991
description:
Feb  6 02:43:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-02-06 02:43:13 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:37512: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
country_id: 272103
description:
Feb  6 02:42:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
country_id: 1835841
description:
Feb  6 02:42:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-02-06 02:43:01 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:48280: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.133.238
country_id: 1814991
description:
Feb  6 02:43:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
country_id: 1819730
description:
2025-02-06 02:43:15 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:35679: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.236.91.93
country_id: 1814991
description:
2025-02-06 02:43:28 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [42.236.91.93]:56450: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
country_id: 458258
description:
Feb  6 02:42:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
country_id: 1819730
description:
Feb  6 02:43:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 02:43:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.135.254
country_id: 1814991
description:
2025-02-06 02:43:08 dovecot_plain authenticator failed for ([60.171.135.254]) [60.171.135.254]:41617: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  6 02:43:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Feb  6 02:42:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
country_id: 3469034
description:
Feb  6 02:42:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 02:42:58 ait sshd[932241]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
country_id: 1819730
description:
Feb  6 02:43:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
country_id: 337996
description:
2025-02-06 02:43:17 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:51344: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
country_id: 3469034
description:
2025-02-06 02:42:54 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:33042: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.18.217
country_id: 1814991
description:
Feb  6 02:42:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.18.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-02-06 02:42:56 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:42244: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
country_id: 3585968
description:
Feb  6 02:43:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
country_id: 337996
description:
2025-02-06 02:43:10 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:34944: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-02-06 02:42:54 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:54348: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
country_id: 3469034
description:
Feb  6 02:42:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
country_id: 1269750
description:
Feb  6 02:43:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
country_id: 1269750
description:
2025-02-06 02:43:15 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:58148: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
country_id: 6252001
description:
Feb  6 02:43:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.214.147
country_id: 2750405
description:
Feb  6 02:42:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.214.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
country_id: 1835841
description:
Feb  6 02:42:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.30.217.31
country_id: 2017370
description:
2025-02-06 02:42:53 dovecot_plain authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:54178: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
country_id: 1814991
description:
2025-02-06 02:42:57 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:54716: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
country_id: 2017370
description:
Feb  6 02:43:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
country_id: 1835841
description:
2025-02-06 02:42:55 dovecot_plain authenticator failed for ([220.77.182.169]) [220.77.182.169]:51186: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
country_id: 3469034
description:
Feb  6 02:43:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-06 02:43:20 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:51458: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
country_id: 617790
description:
Feb  6 02:43:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
country_id: 1814991
description:
Feb  6 02:43:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
country_id: 1269750
description:
2025-02-06 02:42:56 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:48840: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
country_id: 2077456
description:
2025-02-06 02:43:00 dovecot_plain authenticator failed for (210-84-5-183.tpgi.com.au) [210.84.5.183]:57408: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
country_id: 2328926
description:
Feb  6 02:43:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.250
country_id: 1814991
description:
2025-02-06 02:43:11 dovecot_plain authenticator failed for ([27.40.100.250]) [27.40.100.250]:48383: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
country_id: 1269750
description:
Feb  6 02:43:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
country_id: 6252001
description:
2025-02-06 02:43:00 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:41692: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
country_id: 2017370
description:
2025-02-06 02:43:01 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:59500: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-06 02:43:14 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:55120: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
country_id: 2017370
description:
2025-02-06 02:43:24 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:55190: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
country_id: 1814991
description:
Feb  6 02:42:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
country_id: 2077456
description:
Feb  6 02:43:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.34
country_id: 617790
description:
2025-02-06 02:43:08 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:41616: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.196
country_id: 6252001
description:
Feb  6 02:43:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
country_id: 2661886
description:
2025-02-06 02:43:21 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:44176: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
country_id: 1269750
description:
2025-02-06 02:43:21 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:55953: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-06 02:43:24 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:49350: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
country_id: 6252001
description:
Feb  6 02:42:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2025-02-06 02:43:01 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:56668: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.133.238
country_id: 1814991
description:
2025-02-06 02:43:14 dovecot_plain authenticator failed for ([123.139.133.238]) [123.139.133.238]:39014: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.121.12
country_id: 1814991
description:
2025-02-06 02:43:16 dovecot_plain authenticator failed for ([61.146.121.12]) [61.146.121.12]:45061: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.171
country_id: 1668284
description:
2025-02-06 02:43:14 dovecot_plain authenticator failed for 111-70-21-171.emome-ip.hinet.net [111.70.21.171]:42521: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.121.12
country_id: 1814991
description:
Feb  6 02:43:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.121.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 02:43:15 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:34553: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
country_id: 337996
description:
2025-02-06 02:42:54 dovecot_plain authenticator failed for ([196.191.212.238]) [196.191.212.238]:44596: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  6 02:42:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.149
country_id: 3996063
description:
Feb  6 02:43:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-06 02:43:05 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:54454: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
country_id: 2029969
description:
2025-02-06 02:43:05 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:40464: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
country_id: 3469034
description:
Feb  6 02:43:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-02-06 02:43:34 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:52520: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
country_id: 1835841
description:
Feb  6 02:43:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
country_id: 1835841
description:
2025-02-06 02:43:36 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:55950: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.253
country_id: 99237
description:
2025-02-06 02:44:12 dovecot_plain authenticator failed for (knondes) [65.20.129.253]:54061: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-02-06 02:43:29 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:33740: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
country_id: 3595528
description:
Feb  6 02:43:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 92.62.123.86
country_id: 3425505
domain: afaccra.u3l.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/Mhbgf.php||SC:/home/titlemas/public_html/afaccra.u3l.us/wp-admin/images/Mhbgf.php


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 02:44:21 ait sshd[932701]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-06 02:43:30 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:49866: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
country_id: 3625428
description:
2025-02-06 02:43:31 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:53370: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.215
country_id: 6252001
description:
Feb  6 02:43:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 92.62.123.86
country_id: 3425505
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:02-43.92.62.123.86||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
country_id: 1814991
description:
Feb  6 02:44:21 ait sshd[932701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.253
country_id: 99237
description:
Feb  6 02:44:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
country_id: 3625428
description:
Feb  6 02:43:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.215
country_id: 6252001
description:
2025-02-06 02:43:37 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:43844: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.209.16.253
country_id: 927384
description:
Feb  6 02:44:49 ait sshd[932750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.209.16.253 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.255.208
country_id: 3469034
description:
[2025-02-06 02:45:01 +0100] info [webmaild] 138.118.255.208 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.6
country_id: 6252001
description:
2025-02-06 02:45:25 dovecot_login authenticator failed for ([104.241.231.6]) [104.241.231.6]:58212: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.29.175
country_id: 3865483
description:
Feb  6 02:44:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.29.175 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.209.16.253
country_id: 927384
description:
Feb  6 02:44:49 ait sshd[932750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.209.16.253  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.196.55
country_id: 3469034
description:
[2025-02-06 02:45:10 +0100] info [webmaild] 45.175.196.55 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.6
country_id: 6252001
description:
Feb  6 02:45:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.134.90.126
country_id: 3469034
description:
[2025-02-06 02:44:34 +0100] info [webmaild] 177.134.90.126 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.29.232.114
country_id: 3686110
description:
Feb  6 02:45:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.29.232.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.29.232.114
country_id: 3686110
description:
2025-02-06 02:45:40 dovecot_login authenticator failed for (c20029232-114.consulnetworks.com.co) [200.29.232.114]:36558: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.129.60
country_id: 3469034
description:
[2025-02-06 02:45:43 +0100] info [webmaild] 177.221.129.60 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
country_id: 1562822
description:
Feb  6 02:47:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
country_id: 2017370
description:
2025-02-06 02:47:23 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:36676: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
country_id: 1814991
description:
Feb  6 02:46:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-06 02:46:39 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:50240: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
country_id: 1210997
description:
2025-02-06 02:46:58 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:56596: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.118.53
country_id: 3865483
description:
Feb  6 02:47:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.118.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.92.220
country_id: 1643084
description:
Feb  6 02:46:40 ait sshd[933528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.92.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-06 02:46:52 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:59139: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-02-06 02:47:14 dovecot_plain authenticator failed for ([167.250.118.53]) [167.250.118.53]:60110: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2025-02-06 02:47:22 dovecot_plain authenticator failed for ([120.238.23.168]) [120.238.23.168]:56103: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  6 02:46:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.92.220
country_id: 1643084
description:
Feb  6 02:46:40 ait sshd[933528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.92.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Feb  6 02:46:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-02-06 02:47:15 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:40486: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.57.72.180
country_id: 1522867
description:
[2025-02-06 02:47:22 +0100] info [webmaild] 185.57.72.180 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
country_id: 1814991
description:
2025-02-06 02:46:37 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:34091: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
country_id: 1814991
description:
Feb  6 02:46:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
country_id: 1814991
description:
2025-02-06 02:46:56 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:54440: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2025-02-06 02:46:58 dovecot_plain authenticator failed for ([114.202.80.152]) [114.202.80.152]:52412: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.23.168
country_id: 1814991
description:
Feb  6 02:47:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.23.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
country_id: 2017370
description:
Feb  6 02:47:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.53.112
country_id: 1880251
description:
47.128.53.112 - - [06/Feb/2025:02:46:36 +0100] "GET /data1/images/image1.jpg HTTP/2.0" 415 176 ait-edu.us "https://ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23203401" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.53.112


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
country_id: 3469034
description:
Feb  6 02:46:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
country_id: 1210997
description:
Feb  6 02:46:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
country_id: 1814991
description:
Feb  6 02:47:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
country_id: 1814991
description:
Feb  6 02:46:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
country_id: 1814991
description:
2025-02-06 02:46:56 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:2882: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
country_id: 1814991
description:
2025-02-06 02:47:11 dovecot_plain authenticator failed for ([222.68.132.206]) [222.68.132.206]:35289: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.108.215.31
country_id: 3378535
description:
[2025-02-06 02:48:23 +0100] info [webmaild] 190.108.215.31 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 02:47:50 ait sshd[933752]: pam_imunify(sshd:auth): [IM360_RBL] The IP 84.22.115.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 84.22.115.60
country_id: 2750405
description:
Feb  6 02:47:50 ait sshd[933752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=84.22.115.60  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.140.93.174
country_id: 3658394
description:
[2025-02-06 02:47:50 +0100] info [webmaild] 192.140.93.174 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 80.94.95.157
country_id: 798549
domain: www.admissions.ait.edu.gh
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/TOPXOH/wDR.php||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.136.184
country_id: 3658394
description:
[2025-02-06 02:47:49 +0100] info [webmaild] 157.100.136.184 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
country_id: 1269750
description:
Feb  6 02:49:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.92.25.206
country_id: 1835841
description:
Feb  6 02:49:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.92.25.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.240
country_id: 1269750
description:
2025-02-06 02:48:55 dovecot_plain authenticator failed for (nsg-corporate-240.226.187.122.airtel.in) [122.187.226.240]:44960: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
country_id: 3175395
description:
Feb  6 02:49:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
country_id: 3175395
description:
Feb  6 02:49:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
country_id: 192950
description:
2025-02-06 02:49:10 dovecot_plain authenticator failed for (41.84.132.142.liquidtelecom.net) [41.84.132.142]:54730: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.13.243.101
country_id: 2264397
description:
2025-02-06 02:49:27 dovecot_plain authenticator failed for bl3-243-101.dsl.telepac.pt [213.13.243.101]:2487: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  6 02:48:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.124.204
country_id: 2215636
description:
2025-02-06 02:49:05 dovecot_plain authenticator failed for (sporaippon) [165.16.124.204]:55363: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
country_id: 192950
description:
Feb  6 02:49:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
country_id: 99237
description:
Feb  6 02:49:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.13.243.101
country_id: 2264397
description:
Feb  6 02:49:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.13.243.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 02:49:04 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:44130: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 02:48:35 ait sshd[933965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.227.2.181  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
country_id: 1269750
description:
2025-02-06 02:49:16 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:52290: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
country_id: 3175395
description:
2025-02-06 02:49:20 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:45992: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 02:48:35 ait sshd[933965]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.227.2.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 02:49:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
country_id: 3175395
description:
2025-02-06 02:49:09 dovecot_plain authenticator failed for (ajorm) [82.84.122.203]:60651: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
country_id: 99237
description:
2025-02-06 02:49:25 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:46776: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.226.240
country_id: 1269750
description:
Feb  6 02:48:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.226.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-06 02:48:52 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:9862: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.124.204
country_id: 2215636
description:
Feb  6 02:49:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.124.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.92.25.206
country_id: 1835841
description:
2025-02-06 02:49:16 dovecot_plain authenticator failed for ([220.92.25.206]) [220.92.25.206]:42594: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
country_id: 99237
description:
2025-02-06 02:50:29 dovecot_plain authenticator failed for (choschies) [65.20.165.83]:32974: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
country_id: 1814991
description:
Feb  6 02:49:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
country_id: 1814991
description:
2025-02-06 02:49:56 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:43281: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.53.126.112
country_id: 1835841
description:
Feb  6 02:50:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.53.126.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.53.126.112
country_id: 1835841
description:
2025-02-06 02:50:25 dovecot_login authenticator failed for ([14.53.126.112]) [14.53.126.112]:42176: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
country_id: 99237
description:
Feb  6 02:50:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.10.2.218
country_id: 3469034
description:
[2025-02-06 02:50:27 +0100] info [webmaild] 177.10.2.218 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.43.146.92
country_id: 3469034
description:
[2025-02-06 02:50:39 +0100] info [webmaild] 177.43.146.92 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
country_id: 2077456
description:
2025-02-06 02:50:43 dovecot_login authenticator failed for ([144.48.233.190]) [144.48.233.190]:60784: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.219.166.254
country_id: 3865483
description:
[2025-02-06 02:50:57 +0100] info [webmaild] 201.219.166.254 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
country_id: 3469034
description:
Feb  6 02:51:19 ait sshd[934891]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 02:50:56 ait sshd[934722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.149.110.114
country_id: 3469034
description:
[2025-02-06 02:51:09 +0100] info [webmaild] 201.149.110.114 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  6 02:50:56 ait sshd[934722]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
country_id: 3469034
description:
Feb  6 02:51:19 ait sshd[934891]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
country_id: 2077456
description:
Feb  6 02:50:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.191.180
country_id: 6252001
description:
Feb  6 02:51:55 ait sshd[935243]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.93.191.180 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.93.191.180
country_id: 6252001
description:
Feb  6 02:51:55 ait sshd[935243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.93.191.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.27
country_id: 1814991
description:
Feb  6 02:52:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.27
country_id: 1814991
description:
2025-02-06 02:52:16 dovecot_plain authenticator failed for ([182.135.66.27]) [182.135.66.27]:38992: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 02:52:34 ait sshd[935489]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.205.231.159 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
country_id: 2921044
description:
Feb  6 02:52:34 ait sshd[935489]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
country_id: 2635167
description:
2025-02-06 02:52:34 dovecot_plain authenticator failed for (199.35.89.239.bcube.co.uk) [89.35.199.239]:56460: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
country_id: 1819730
description:
Feb  6 02:52:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.53.96.122
country_id: 3686110
description:
[2025-02-06 02:53:03 +0100] info [webmaild] 181.53.96.122 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-53.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.179.8.86
country_id: 3469034
description:
[2025-02-06 02:53:25 +0100] info [webmaild] 179.179.8.86 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
country_id: 1814991
description:
Feb  6 02:52:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
country_id: 2635167
description:
Feb  6 02:52:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
country_id: 1814991
description:
2025-02-06 02:52:34 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:57291: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
country_id: 1819730
description:
2025-02-06 02:52:45 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:52662: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
country_id: 6251999
description:
Feb  6 02:53:42 ait sshd[935742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.253.214.104
country_id: 587116
description:
[2025-02-06 02:53:53 +0100] info [webmaild] 188.253.214.104 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 02:54:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.184.180.100
country_id: 3469034
description:
[2025-02-06 02:53:37 +0100] info [webmaild] 177.184.180.100 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
country_id: 6251999
description:
Feb  6 02:53:42 ait sshd[935742]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
country_id: 1269750
description:
2025-02-06 02:55:20 dovecot_login authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:34217: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.25
country_id: 1562822
description:
Feb  6 02:54:28 ait sshd[935935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.25


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
country_id: 3017382
description:
Feb  6 02:55:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
country_id: 3017382
description:
2025-02-06 02:55:14 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:40486: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
country_id: 1269750
description:
Feb  6 02:55:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.163.103
country_id: 99237
description:
Feb  6 02:55:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.163.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.25
country_id: 1562822
description:
Feb  6 02:54:28 ait sshd[935935]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
country_id: 1269750
description:
Feb  6 02:55:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.209.207.75
country_id: 3469034
description:
[2025-02-06 02:55:56 +0100] info [webmaild] 186.209.207.75 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
country_id: 1643084
description:
Feb  6 02:56:00 ait sshd[936396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.221.19
country_id: 3469034
description:
[2025-02-06 02:56:27 +0100] info [webmaild] 186.233.221.19 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.130
country_id: 1835841
description:
2025-02-06 02:55:30 dovecot_plain authenticator failed for ([123.212.0.130]) [123.212.0.130]:59940: 535 Incorrect authentication data (set_id=ddessel)


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 213.136.78.38
country_id: 3017382
domain: ait.edu.gh
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:ARGS:fw||MV:fwrite||RSV:6.65||T:APACHE||SC:/home/ait02/public_html/wp-content/plugins/wp-ver.php


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
country_id: 2510769
description:
Feb  6 02:55:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 02:55:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
country_id: 1643084
description:
Feb  6 02:56:00 ait sshd[936396]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.229.170.50
country_id: 298795
description:
[2025-02-06 02:55:33 +0100] info [webmaild] 88.229.170.50 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.6.119
country_id: 1814991
description:
Feb  6 02:55:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.6.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
country_id: 1814991
description:
2025-02-06 02:55:37 dovecot_login authenticator failed for (119.6.17.58.adsl-pool.jx.chinaunicom.com) [58.17.6.119]:48091: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
country_id: 3469034
description:
Feb  6 02:56:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
country_id: 6252001
description:
Feb  6 02:56:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.130
country_id: 1835841
description:
Feb  6 02:55:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.130 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 213.136.78.38
country_id: 3017382
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:02-55.213.136.78.38||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
country_id: 1269750
description:
2025-02-06 02:55:58 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:60660: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-02-06 02:55:28 dovecot_plain authenticator failed for (derged) [65.20.163.103]:43956: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.37.2.101
country_id: 3865483
description:
[2025-02-06 02:56:10 +0100] info [webmaild] 179.37.2.101 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
country_id: 6252001
description:
2025-02-06 02:56:14 dovecot_login authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:47791: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.66
country_id: 6251999
description:
Feb  6 02:56:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.84.62.213
country_id: 1269750
description:
Feb  6 02:56:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.84.62.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.84.62.213
country_id: 1269750
description:
2025-02-06 02:56:39 dovecot_plain authenticator failed for ([103.177.205.100]) [58.84.62.213]:30011: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  6 02:57:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.66
country_id: 6251999
description:
2025-02-06 02:56:29 dovecot_plain authenticator failed for s142-59-214-66.ab.hsia.telus.net [142.59.214.66]:41348: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
country_id: 1269750
description:
Feb  6 02:56:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
country_id: 1269750
description:
2025-02-06 02:56:35 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:54550: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.97.132.7
country_id: 1562822
description:
Feb  6 02:56:43 ait sshd[936741]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.97.132.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.97.132.7
country_id: 1562822
description:
Feb  6 02:56:43 ait sshd[936741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.97.132.7


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
country_id: 6251999
description:
Feb  6 02:57:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-02-06 02:57:17 dovecot_plain authenticator failed for (prialrops) [64.72.74.162]:35991: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.110.180.0
country_id: 1269750
description:
Feb  6 02:57:41 ait sshd[936940]: pam_imunify(sshd:auth): [IM360_RBL] The IP 143.110.180.0 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.61.53
country_id: 1861060
description:
Feb  6 02:58:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.61.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.61.53
country_id: 1861060
description:
2025-02-06 02:58:06 dovecot_login authenticator failed for p168053-obmd01.tokyo.ocn.ne.jp [153.141.61.53]:60275: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.201.59.224
country_id: 1835841
description:
Feb  6 02:57:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.201.59.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  6 02:57:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.136.108.201
country_id: 1814991
description:
Feb  6 02:58:11 ait sshd[937103]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.136.108.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
country_id: 6252001
description:
2025-02-06 02:58:17 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:49049: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.33.79
country_id: 1819730
description:
Feb  6 02:58:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.33.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.167.42
country_id: 1605651
description:
2025-02-06 02:57:50 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:53364: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
country_id: 6252001
description:
Feb  6 02:58:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
country_id: 1269750
description:
2025-02-06 02:58:08 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:40190: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.61.112.11
country_id: 3469034
description:
[2025-02-06 02:58:13 +0100] info [webmaild] 187.61.112.11 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
country_id: 6252001
description:
Feb  6 02:58:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
country_id: 6252001
description:
2025-02-06 02:58:21 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:55239: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.70.70
country_id: 1814991
description:
2025-02-06 02:58:23 dovecot_plain authenticator failed for ([1.26.70.70]) [1.26.70.70]:39145: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.110.180.0
country_id: 1269750
description:
Feb  6 02:57:41 ait sshd[936940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.110.180.0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-06 02:57:44 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:7976: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
country_id: 298795
description:
Feb  6 02:58:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
country_id: 298795
description:
2025-02-06 02:58:03 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:42764: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
country_id: 1269750
description:
Feb  6 02:58:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.136.108.201
country_id: 1814991
description:
Feb  6 02:58:11 ait sshd[937103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.136.108.201


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.158.71.166
country_id: 3017382
description:
Feb  6 02:57:30 ait sshd[936932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.71.166  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.167.42
country_id: 1605651
description:
Feb  6 02:57:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.167.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.70.70
country_id: 1814991
description:
Feb  6 02:58:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
country_id: 2413451
description:
Feb  6 02:58:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2025-02-06 02:58:53 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:60702: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.188.85
country_id: 1814991
description:
Feb  6 02:59:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.188.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
country_id: 3017382
description:
2025-02-06 02:58:35 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:36238: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
country_id: 1814991
description:
Feb  6 02:58:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.63.175
country_id: 1814991
description:
Feb  6 02:58:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.63.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.247.184.12
country_id: 2017370
description:
2025-02-06 02:58:36 dovecot_plain authenticator failed for ([194.247.184.12]) [194.247.184.12]:51502: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.154
country_id: 1668284
description:
2025-02-06 02:58:55 dovecot_plain authenticator failed for 111-70-22-154.emome-ip.hinet.net [111.70.22.154]:54264: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
country_id: 1269750
description:
Feb  6 02:59:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  6 02:58:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
country_id: 2635167
description:
Feb  6 02:58:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
country_id: 1819730
description:
2025-02-06 02:58:46 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:56394: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
country_id: 1835841
description:
2025-02-06 02:58:47 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:53850: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
country_id: 6252001
description:
2025-02-06 02:58:31 dovecot_login authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:51425: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.37.37.166
country_id: 1269750
description:
Feb  6 02:58:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.37.37.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
country_id: 1819730
description:
Feb  6 02:58:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
country_id: 3017382
description:
Feb  6 02:58:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Feb  6 02:58:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 163.53.25.174
country_id: 1282988
description:
[2025-02-06 02:58:52 +0100] info [webmaild] 163.53.25.174 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
country_id: 1814991
description:
Feb  6 02:58:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-06 02:58:50 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:56436: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
country_id: 3017382
description:
2025-02-06 02:58:52 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:43862: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.176.170.160
country_id: 2510769
description:
Feb  6 02:58:54 ait sshd[937243]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.176.170.160  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
country_id: 1835841
description:
2025-02-06 02:59:11 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:45616: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
country_id: 798544
description:
Feb  6 02:58:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.52.116
country_id: 1814991
description:
2025-02-06 02:58:37 dovecot_plain authenticator failed for ([111.53.52.116]) [111.53.52.116]:54256: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.30.217.31
country_id: 2017370
description:
Feb  6 02:58:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.30.217.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-06 02:59:24 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:45612: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.228.131
country_id: 1835841
description:
Feb  6 02:58:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.228.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
country_id: 2400553
description:
Feb  6 02:58:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
country_id: 1835841
description:
2025-02-06 02:58:53 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:40739: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2025-02-06 02:58:53 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:36680: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
country_id: 1819730
description:
2025-02-06 02:58:35 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:8259: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.130
country_id: 1835841
description:
2025-02-06 02:58:37 dovecot_plain authenticator failed for ([1.235.192.130]) [1.235.192.130]:40556: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-06 02:58:39 dovecot_login authenticator failed for ([186.200.8.115]) [186.200.249.162]:47781: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.95.174
country_id: 3624060
description:
2025-02-06 02:58:43 dovecot_plain authenticator failed for ([186.177.95.174]) [186.177.95.174]:58017: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
country_id: 878675
description:
Feb  6 02:58:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.176.170.160
country_id: 2510769
description:
Feb  6 02:58:54 ait sshd[937243]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.176.170.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
country_id: 798544
description:
2025-02-06 02:58:36 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:54434: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.130
country_id: 1835841
description:
Feb  6 02:58:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
country_id: 1819730
description:
Feb  6 02:58:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
country_id: 1819730
description:
2025-02-06 02:58:52 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:24367: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
country_id: 1819730
description:
Feb  6 02:59:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.42.10
country_id: 1880251
description:
47.128.42.10 - - [06/Feb/2025:02:58:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=31636246 HTTP/2.0" 302 0 fr.vss.ait-edu.us "https://fr.vss.ait-edu.us/p3/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.42.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
country_id: 2635167
description:
2025-02-06 02:58:40 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:54793: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
country_id: 6252001
description:
Feb  6 02:58:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
country_id: 1814991
description:
2025-02-06 02:58:49 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:48266: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.29.157
country_id: 3865483
description:
Feb  6 02:58:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.29.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
country_id: 3996063
description:
2025-02-06 02:58:51 dovecot_plain authenticator failed for (201.172.170.49-clientes-izzi.mx) [201.172.170.49]:58452: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
country_id: 6252001
description:
2025-02-06 02:58:58 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:49279: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.137
country_id: 1814991
description:
2025-02-06 02:58:59 dovecot_plain authenticator failed for ([119.62.184.137]) [119.62.184.137]:40699: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
country_id: 6252001
description:
Feb  6 02:58:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
country_id: 1819730
description:
Feb  6 02:58:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.98.179.132
country_id: 1814991
description:
Feb  6 02:58:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.98.179.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
country_id: 1819730
description:
2025-02-06 02:59:03 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:62277: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
country_id: 1814991
description:
2025-02-06 02:59:07 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:8066: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
country_id: 337996
description:
Feb  6 02:58:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
country_id: 878675
description:
2025-02-06 02:58:51 dovecot_plain authenticator failed for ([196.201.20.98]) [41.190.39.142]:56868: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.228.131
country_id: 1835841
description:
2025-02-06 02:58:52 dovecot_plain authenticator failed for ([183.99.228.131]) [183.99.228.131]:52748: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.161.166.113
country_id: 3017382
description:
Feb  6 02:58:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.161.166.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
country_id: 1819730
description:
2025-02-06 02:58:38 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:56108: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
country_id: 1819730
description:
Feb  6 02:58:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.108.14.225
country_id: 1814991
description:
Feb  6 02:58:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.108.14.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.154
country_id: 1668284
description:
Feb  6 02:58:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.108.14.225
country_id: 1814991
description:
2025-02-06 02:58:40 dovecot_plain authenticator failed for ([202.108.14.226]) [202.108.14.225]:55388: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
country_id: 1835841
description:
Feb  6 02:58:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.33.134
country_id: 3469034
description:
[2025-02-06 02:58:46 +0100] info [webmaild] 45.70.33.134 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
country_id: 1835841
description:
Feb  6 02:59:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.247.184.12
country_id: 2017370
description:
Feb  6 02:58:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.247.184.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  6 02:58:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.252.197.3
country_id: 732800
description:
Feb  6 02:58:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.252.197.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2025-02-06 02:58:53 dovecot_plain authenticator failed for ([170.233.29.157]) [170.233.29.157]:42718: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.179.132
country_id: 1814991
description:
2025-02-06 02:58:38 dovecot_plain authenticator failed for ([112.98.179.132]) [112.98.179.132]:39302: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.177.95.174
country_id: 3624060
description:
Feb  6 02:58:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.177.95.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
country_id: 3996063
description:
Feb  6 02:58:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
country_id: 1814991
description:
2025-02-06 02:59:09 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:48406: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
country_id: 1814991
description:
2025-02-06 02:58:39 dovecot_plain authenticator failed for ([182.135.63.175]) [182.135.63.175]:56155: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
country_id: 2413451
description:
2025-02-06 02:58:51 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:43354: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-06 02:58:53 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:53977: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
country_id: 1819730
description:
Feb  6 02:58:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
country_id: 1835841
description:
Feb  6 02:58:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
country_id: 1562822
description:
Feb  6 02:58:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
country_id: 1562822
description:
2025-02-06 02:58:38 dovecot_plain authenticator failed for ([171.227.200.201]) [171.227.200.201]:26362: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
country_id: 1819730
description:
2025-02-06 02:58:39 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:42942: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
country_id: 6252001
description:
Feb  6 02:58:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
country_id: 1814991
description:
Feb  6 02:59:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-06 02:58:37 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:49684: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.252.197.3
country_id: 732800
description:
2025-02-06 02:58:39 dovecot_plain authenticator failed for ([151.252.197.3]) [151.252.197.3]:56860: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.30.217.31
country_id: 2017370
description:
2025-02-06 02:58:45 dovecot_plain authenticator failed for 95-30-217-31.broadband.corbina.ru [95.30.217.31]:54270: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.26.98
country_id: 3469034
description:
[2025-02-06 02:58:38 +0100] info [webmaild] 45.163.26.98 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.137
country_id: 1814991
description:
Feb  6 02:58:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.171
country_id: 99237
description:
Feb  6 02:59:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-02-06 02:59:43 dovecot_plain authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:43219: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
country_id: 1814991
description:
Feb  6 03:00:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
country_id: 2661886
description:
2025-02-06 03:00:20 dovecot_login authenticator failed for 31-208-136-225.cust.bredband2.com [31.208.136.225]:52519: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.66.154.229
country_id: 3017382
description:
2025-02-06 03:00:21 dovecot_plain authenticator failed for (nemes) [98.66.154.229]:50262: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
country_id: 1269750
description:
Feb  6 02:59:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.158.71.166
country_id: 3017382
description:
Feb  6 02:59:58 ait sshd[937505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.158.71.166  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 02:59:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
country_id: 1269750
description:
2025-02-06 02:59:59 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:37560: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
country_id: 1814991
description:
2025-02-06 03:00:10 dovecot_login authenticator failed for ([123.182.89.19]) [123.182.89.19]:41251: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
country_id: 2661886
description:
Feb  6 03:00:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.171
country_id: 99237
description:
2025-02-06 02:59:38 dovecot_plain authenticator failed for (pastalless) [65.20.129.171]:39937: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.199.165
country_id: 2077456
description:
Feb  6 02:59:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.66.154.229
country_id: 3017382
description:
Feb  6 03:00:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.66.154.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
country_id: 1835841
description:
Feb  6 03:00:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 03:00:36 ait sshd[937966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
country_id: 1880251
description:
Feb  6 03:00:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
country_id: 2017370
description:
2025-02-06 03:00:48 dovecot_login authenticator failed for (5x167x48x130.dynamic.rostov.ertelecom.ru) [5.167.48.130]:51947: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
country_id: 1880251
description:
2025-02-06 03:00:48 dovecot_login authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:35234: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.131.175.67
country_id: 1835841
description:
Feb  6 03:01:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.131.175.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
country_id: 1835841
description:
2025-02-06 03:00:31 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:54898: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 03:00:36 ait sshd[937966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.71.27.234
country_id: 1562822
description:
Feb  6 03:00:45 ait sshd[937977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.71.27.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.4.93
country_id: 1562822
description:
2025-02-06 03:00:46 dovecot_login authenticator failed for (31094-49731.bacloud.info.) [117.4.4.93]:52455: 535 Incorrect authentication data (set_id=eng17b00218y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
country_id: 2017370
description:
Feb  6 03:00:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.131.175.67
country_id: 1835841
description:
2025-02-06 03:01:20 dovecot_plain authenticator failed for ([118.131.175.67]) [118.131.175.67]:46031: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.4.93
country_id: 1562822
description:
Feb  6 03:00:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.4.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.234
country_id: 1562822
description:
Feb  6 03:00:45 ait sshd[937977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 27.71.27.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.59.45.48
country_id: 1522867
description:
[2025-02-06 03:00:59 +0100] info [webmaild] 95.59.45.48 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.225.134.13
country_id: 1835841
description:
2025-02-06 03:00:58 dovecot_login authenticator failed for ([182.225.134.13]) [182.225.134.13]:43973: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.249.166.33
country_id: 2017370
description:
[2025-02-06 03:00:52 +0100] info [webmaild] 85.249.166.33 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.225.134.13
country_id: 1835841
description:
Feb  6 03:00:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.225.134.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.57.230.79
country_id: 3469034
description:
[2025-02-06 03:01:27 +0100] info [webmaild] 187.57.230.79 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
country_id: 3017382
description:
Feb  6 03:02:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
country_id: 3017382
description:
2025-02-06 03:02:21 dovecot_plain authenticator failed for (clost) [185.113.51.55]:51227: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.89.47.205
country_id: 2328926
description:
[2025-02-06 03:01:32 +0100] info [webmaild] 102.89.47.205 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  6 03:02:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-06 03:02:03 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:60627: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 03:02:08 ait sshd[938551]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
country_id: 2510769
description:
Feb  6 03:02:08 ait sshd[938551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
country_id: 1819730
description:
Feb  6 03:02:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.97.188.123
country_id: 3865483
description:
[2025-02-06 03:03:20 +0100] info [webmaild] 181.97.188.123 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
country_id: 1819730
description:
2025-02-06 03:02:50 dovecot_login authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:32911: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2025-02-06 03:02:51 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:48716: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.66.55.50
country_id: 1643084
domain: u3l.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/wp-conflg.php||SC:/home/titlemas/public_html/U3L.US/wp-content


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Feb  6 03:03:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
country_id: 3865483
description:
2025-02-06 03:03:09 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:65321: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 03:02:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Feb  6 03:02:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-02-06 03:03:08 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:37778: 535 Incorrect authentication data (set_id=dm)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 157.66.55.50
country_id: 1643084
domain: u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:03-02.157.66.55.50||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  6 03:03:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 03:03:03 dovecot_plain authenticator failed for (stochobia) [31.220.168.116]:36443: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
country_id: 3865483
description:
Feb  6 03:03:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.189.94.8
country_id: 3469034
description:
[2025-02-06 03:03:31 +0100] info [webmaild] 181.189.94.8 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.73.170.127
country_id: 953987
description:
[2025-02-06 03:03:53 +0100] info [webmaild] 165.73.170.127 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.157.227
country_id: 99237
description:
Feb  6 03:03:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.157.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.157.227
country_id: 99237
description:
2025-02-06 03:04:00 dovecot_plain authenticator failed for (shmaste) [65.20.157.227]:52969: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.200.100
country_id: 3437598
description:
[2025-02-06 03:04:01 +0100] info [webmaild] 186.158.200.100 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
country_id: 953987
description:
Feb  6 03:04:16 ait sshd[939086]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
country_id: 953987
description:
Feb  6 03:04:16 ait sshd[939086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 03:05:11 ait sshd[939417]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 03:04:58 ait sshd[939168]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
country_id: 1643084
description:
Feb  6 03:04:58 ait sshd[939168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 03:05:11 ait sshd[939417]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
country_id: 1814991
description:
Feb  6 03:05:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
country_id: 1269750
description:
Feb  6 03:05:43 ait sshd[939606]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
country_id: 2215636
description:
2025-02-06 03:05:48 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:49968: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
country_id: 6252001
description:
Feb  6 03:05:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
country_id: 1814991
description:
Feb  6 03:05:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.98.215
country_id: 3865483
description:
[2025-02-06 03:05:58 +0100] info [webmaild] 168.232.98.215 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.255.194.136
country_id: 3469034
description:
[2025-02-06 03:06:27 +0100] info [webmaild] 138.255.194.136 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
country_id: 6252001
description:
2025-02-06 03:05:30 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:4478: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
country_id: 1269750
description:
Feb  6 03:05:43 ait sshd[939606]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
country_id: 2215636
description:
Feb  6 03:05:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2025-02-06 03:05:54 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:60474: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.4.133
country_id: 2017370
description:
2025-02-06 03:06:26 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:47069: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.156.198
country_id: 1814991
description:
2025-02-06 03:05:35 dovecot_plain authenticator failed for ([116.116.156.198]) [116.116.156.198]:55947: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.188.95.18
country_id: 3625428
description:
[2025-02-06 03:05:55 +0100] info [webmaild] 186.188.95.18 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.4.133
country_id: 2017370
description:
Feb  6 03:06:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.4.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
country_id: 1835841
description:
2025-02-06 03:06:43 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:59584: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.84.154.106
country_id: 6252001
description:
Feb  6 03:06:48 ait sshd[939904]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.84.154.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
country_id: 6252001
description:
Feb  6 03:06:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
country_id: 6252001
description:
2025-02-06 03:07:14 dovecot_login authenticator failed for ([195.252.209.189]) [195.252.209.189]:33602: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.191.187.227
country_id: 3469034
description:
[2025-02-06 03:06:29 +0100] info [webmaild] 177.191.187.227 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.84.154.106
country_id: 6252001
description:
Feb  6 03:06:48 ait sshd[939904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.84.154.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
country_id: 6252001
description:
2025-02-06 03:07:00 dovecot_login authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:55966: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
country_id: 6252001
description:
Feb  6 03:07:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
country_id: 1835841
description:
Feb  6 03:06:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
country_id: 1562822
description:
Feb  6 03:08:08 ait sshd[940473]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
country_id: 1814991
description:
2025-02-06 03:07:49 dovecot_login authenticator failed for ([111.61.175.117]) [111.61.175.117]:33282: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.45.44.84
country_id: 2017370
description:
[2025-02-06 03:07:35 +0100] info [cpaneld] 147.45.44.84 - vondee@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.63.165.16
country_id: 1835841
description:
Feb  6 03:07:46 ait sshd[940415]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.63.165.16


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 03:07:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.199.245
country_id: 798544
description:
2025-02-06 03:07:32 dovecot_login authenticator failed for 5.185.199.245.ipv4.public.orange.pl [5.185.199.245]:55168: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
country_id: 1562822
description:
Feb  6 03:08:08 ait sshd[940473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.56.11.148
country_id: 3175395
description:
Feb  6 03:08:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.56.11.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.199.245
country_id: 798544
description:
Feb  6 03:07:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.199.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.63.165.16
country_id: 1835841
description:
Feb  6 03:07:46 ait sshd[940415]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.63.165.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.70
country_id: 2635167
description:
Feb  6 03:07:54 ait sshd[940433]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.70 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.70
country_id: 2635167
description:
Feb  6 03:07:54 ait sshd[940433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.70  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.202.80
country_id: 1835841
description:
Feb  6 03:07:33 ait sshd[940407]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.251.202.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
country_id: 1835841
description:
Feb  6 03:07:33 ait sshd[940407]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 03:08:03 ait sshd[940468]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
country_id: 3175395
description:
2025-02-06 03:08:24 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:60627: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.117
country_id: 1814991
description:
Feb  6 03:07:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 03:07:51 ait sshd[940428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.241.179.229


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
country_id: 6252001
description:
Feb  6 03:08:03 ait sshd[940468]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 03:07:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-07.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 03:07:51 ait sshd[940428]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.241.179.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.252.3.7
country_id: 3703430
description:
2025-02-06 03:09:08 dovecot_plain authenticator failed for ([38.252.3.7]) [38.252.3.7]:49111: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.158.61.148
country_id: 3469034
description:
[2025-02-06 03:09:11 +0100] info [webmaild] 201.158.61.148 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
country_id: 1562822
description:
2025-02-06 03:09:28 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:10587: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.202.143
country_id: 3658394
description:
[2025-02-06 03:08:28 +0100] info [webmaild] 45.4.202.143 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
country_id: 6252001
description:
Feb  6 03:08:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
country_id: 6252001
description:
2025-02-06 03:08:35 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:34370: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
country_id: 1814991
description:
2025-02-06 03:08:51 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:53190: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
country_id: 1562822
description:
Feb  6 03:09:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.1.36.69
country_id: 3469034
description:
[2025-02-06 03:08:37 +0100] info [webmaild] 187.1.36.69 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
country_id: 1814991
description:
Feb  6 03:08:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.73.106.41
country_id: 953987
description:
[2025-02-06 03:08:58 +0100] info [webmaild] 165.73.106.41 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.3.7
country_id: 3703430
description:
Feb  6 03:09:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.252.3.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.227.218
country_id: 1835841
description:
Feb  6 03:09:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.227.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 03:09:33 ait sshd[940934]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.131.163.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 03:09:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.227.218
country_id: 1835841
description:
2025-02-06 03:09:54 dovecot_plain authenticator failed for ([106.246.227.218]) [106.246.227.218]:50038: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 03:10:19 ait sshd[941328]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 03:10:19 ait sshd[941328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.131.163.41
country_id: 6252001
description:
Feb  6 03:09:33 ait sshd[940934]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.131.163.41  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.60.37.76
country_id: 3686110
description:
[2025-02-06 03:11:10 +0100] info [webmaild] 190.60.37.76 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 03:10:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.16.3.168
country_id: 690791
description:
[2025-02-06 03:11:01 +0100] info [webmaild] 62.16.3.168 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
country_id: 6252001
description:
Feb  6 03:11:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
country_id: 6252001
description:
2025-02-06 03:11:36 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:53804: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.135.156.185
country_id: 2017370
description:
[2025-02-06 03:11:42 +0100] info [webmaild] 213.135.156.185 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.208.53
country_id: 1668284
description:
2025-02-06 03:11:45 H=(mail.ait.edu.gh) [165.154.208.53]:51490 F=<pabjqinjjf@ait.edu.gh> rejected RCPT <validxxxg@gmail.com>: Rejected relay attempt: '165.154.208.53' From: 'pabjqinjjf@ait.edu.gh' To: 'validxxxg@gmail.com'


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
country_id: 1880251
description:
Feb  6 03:11:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
country_id: 1880251
description:
2025-02-06 03:11:50 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:59259: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.25.30.84
country_id: 3932488
description:
[2025-02-06 03:11:30 +0100] info [webmaild] 38.25.30.84 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Feb  6 03:13:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2025-02-06 03:13:12 dovecot_plain authenticator failed for (billavenst) [89.109.233.181]:45824: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 03:13:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.14
country_id: 1814991
description:
Feb  6 03:12:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.230.83.162
country_id: 2661886
description:
Feb  6 03:12:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.230.83.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
country_id: 6252001
description:
Feb  6 03:12:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
country_id: 6252001
description:
2025-02-06 03:12:56 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:53088: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.14
country_id: 1814991
description:
2025-02-06 03:12:42 dovecot_plain authenticator failed for ([124.115.231.14]) [124.115.231.14]:44009: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.230.83.162
country_id: 2661886
description:
2025-02-06 03:12:51 dovecot_plain authenticator failed for 81-230-83-162-no600.tbcn.telia.com (conreepin) [81.230.83.162]:40615: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 03:13:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.75
country_id: 6252001
description:
[2025-02-06 03:14:00 +0100] info [whostmgrd] 156.228.112.75 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.125.180
country_id: 6252001
description:
[2025-02-06 03:14:08 +0100] info [whostmgrd] 156.228.125.180 - abs18b00066y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.109
country_id: 6252001
description:
[2025-02-06 03:14:17 +0100] info [whostmgrd] 104.207.54.109 - abs18b00066y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.43.236
country_id: 1814991
description:
Feb  6 03:13:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.43.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.43.236
country_id: 1814991
description:
2025-02-06 03:13:40 dovecot_plain authenticator failed for ([183.6.43.236]) [183.6.43.236]:35896: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.122
country_id: 6252001
description:
[2025-02-06 03:13:57 +0100] info [cpaneld] 104.207.53.122 - abs18b00066y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs18b00066y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.45.118
country_id: 6252001
description:
[2025-02-06 03:13:58 +0100] info [cpaneld] 104.207.45.118 - abs18b00066y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs18b00066y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.120.68
country_id: 3469034
description:
[2025-02-06 03:13:58 +0100] info [webmaild] 170.231.120.68 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.239.87.6
country_id: 6252001
description:
2025-02-06 03:14:22 dovecot_plain authenticator failed for (hydres) [96.239.87.6]:51430: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
country_id: 1835841
description:
Feb  6 03:13:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
country_id: 1835841
description:
2025-02-06 03:13:57 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:4106: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.184.35.22
country_id: 1814991
description:
Feb  6 03:14:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.184.35.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.47.225
country_id: 6252001
description:
[2025-02-06 03:14:12 +0100] info [whostmgrd] 104.207.47.225 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.45.114.53
country_id: 3469034
description:
[2025-02-06 03:13:31 +0100] info [webmaild] 177.45.114.53 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.218.20.75
country_id: 3469034
description:
[2025-02-06 03:13:41 +0100] info [webmaild] 179.218.20.75 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.60.118
country_id: 6252001
description:
[2025-02-06 03:13:53 +0100] info [cpaneld] 104.207.60.118 - abs18b00066y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user abs18b00066y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.80.203
country_id: 6252001
description:
[2025-02-06 03:14:14 +0100] info [whostmgrd] 156.228.80.203 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.219.171.30
country_id: 3469034
description:
[2025-02-06 03:14:15 +0100] info [webmaild] 181.219.171.30 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.101.252
country_id: 6252001
description:
[2025-02-06 03:13:55 +0100] info [cpaneld] 156.228.101.252 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.4
country_id: 6252001
description:
[2025-02-06 03:13:56 +0100] info [cpaneld] 156.228.87.4 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.184.35.22
country_id: 1814991
description:
2025-02-06 03:14:13 dovecot_login authenticator failed for ([220.189.239.206]) [60.184.35.22]:48266: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.85.81
country_id: 6252001
description:
[2025-02-06 03:14:16 +0100] info [whostmgrd] 156.228.85.81 - abs18b00066y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
country_id: 6252001
description:
Feb  6 03:14:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.246.52.218
country_id: 3144096
description:
2025-02-06 03:15:00 dovecot_plain authenticator failed for 94-246-52.218.3p.ntebredband.no (spary) [94.246.52.218]:37837: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
country_id: 732800
description:
2025-02-06 03:15:01 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:56318: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
country_id: 102358
description:
Feb  6 03:15:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
country_id: 102358
description:
2025-02-06 03:15:12 dovecot_login authenticator failed for ([37.224.119.19]) [37.224.119.19]:43844: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  6 03:14:54 ait sshd[944679]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.254.136.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.254.136.116
country_id: 3017382
description:
Feb  6 03:14:54 ait sshd[944679]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.254.136.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.246.52.218
country_id: 3144096
description:
Feb  6 03:14:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.246.52.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
country_id: 732800
description:
Feb  6 03:14:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
country_id: 2635167
description:
Feb  6 03:15:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
country_id: 2635167
description:
2025-02-06 03:15:04 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (sivanter) [81.143.51.58]:41891: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 03:16:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.91.236
country_id: 3469034
description:
[2025-02-06 03:16:19 +0100] info [webmaild] 45.180.91.236 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
country_id: 3469034
description:
2025-02-06 03:16:29 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:55809: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
country_id: 1269750
description:
Feb  6 03:15:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
country_id: 1269750
description:
2025-02-06 03:15:48 dovecot_plain authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:33512: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.110.208.67
country_id: 3469034
description:
[2025-02-06 03:16:08 +0100] info [webmaild] 187.110.208.67 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
country_id: 3469034
description:
Feb  6 03:16:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.200.168.8
country_id: 1269750
description:
Feb  6 03:17:07 ait sshd[945456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.200.168.8


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.235.185.113
country_id: 3932488
description:
[2025-02-06 03:16:56 +0100] info [webmaild] 190.235.185.113 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
country_id: 617790
description:
2025-02-06 03:16:57 dovecot_login authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:45756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.44.84
country_id: 1880251
description:
47.128.44.84 - - [06/Feb/2025:03:17:00 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16961888" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.44.84


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.35.63
country_id: 1880251
description:
47.128.35.63 - - [06/Feb/2025:03:16:35 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=31675195" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.35.63


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
country_id: 1814991
description:
Feb  6 03:16:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
country_id: 617790
description:
Feb  6 03:16:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.61.116.239
country_id: 3608932
description:
[2025-02-06 03:16:35 +0100] info [webmaild] 190.61.116.239 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.200.168.8
country_id: 1269750
description:
Feb  6 03:17:07 ait sshd[945456]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.200.168.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 03:17:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 03:17:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
country_id: 1814991
description:
2025-02-06 03:16:49 dovecot_login authenticator failed for ([43.143.231.208]) [43.143.231.208]:57688: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.89.146
country_id: 1814991
description:
2025-02-06 03:17:58 dovecot_plain authenticator failed for ([58.18.89.146]) [58.18.89.146]:41177: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.63.242
country_id: 1835841
description:
Feb  6 03:17:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.63.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.89.146
country_id: 1814991
description:
Feb  6 03:17:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.89.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 03:18:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 03:18:12 ait sshd[945834]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 03:18:12 ait sshd[945834]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.41
country_id: 1880251
description:
47.128.52.41 - - [06/Feb/2025:03:17:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21902365 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?filtering=1&level=beginner&price_type=free" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.41


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.63.242
country_id: 1835841
description:
2025-02-06 03:17:48 dovecot_plain authenticator failed for ([1.252.63.242]) [1.252.63.242]:54528: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.190.220.237
country_id: 3469034
description:
[2025-02-06 03:19:12 +0100] info [webmaild] 177.190.220.237 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.59.235.170
country_id: 1814991
description:
2025-02-06 03:19:26 dovecot_plain authenticator failed for ([222.175.187.214]) [218.59.235.170]:52814: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.54.39
country_id: 1880251
description:
47.128.54.39 - - [06/Feb/2025:03:19:29 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9104220" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.39


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 03:19:32 ait sshd[946563]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
country_id: 1835841
description:
Feb  6 03:19:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.73.136.193
country_id: 3703430
description:
[2025-02-06 03:19:25 +0100] info [webmaild] 186.73.136.193 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 03:19:32 ait sshd[946563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.178.220
country_id: 1814991
description:
Feb  6 03:20:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.178.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.154
country_id: 1668284
description:
Feb  6 03:19:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.59.235.170
country_id: 1814991
description:
Feb  6 03:19:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.59.235.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.154
country_id: 1668284
description:
2025-02-06 03:19:16 dovecot_plain authenticator failed for 111-70-22-154.emome-ip.hinet.net [111.70.22.154]:49634: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 03:19:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2025-02-06 03:19:09 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:18582: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.178.220
country_id: 1814991
description:
2025-02-06 03:20:02 dovecot_plain authenticator failed for ([120.197.178.220]) [120.197.178.220]:60386: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  6 03:20:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-06 03:20:15 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:38071: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
country_id: 2017370
description:
Feb  6 03:20:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
country_id: 2017370
description:
2025-02-06 03:20:49 dovecot_plain authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:58522: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.177.247.242
country_id: 1269750
description:
Feb  6 03:20:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.177.247.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.177.247.242
country_id: 1269750
description:
2025-02-06 03:20:34 dovecot_plain authenticator failed for (host-247342.fivenetwork.com) [202.177.247.242]:48242: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 03:21:20 ait sshd[947341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.8.108.52
country_id: 3469034
description:
[2025-02-06 03:21:24 +0100] info [webmaild] 201.8.108.52 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
country_id: 1835841
description:
Feb  6 03:21:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
country_id: 1835841
description:
2025-02-06 03:21:29 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:60400: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 03:21:58 ait sshd[947547]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.237.100.157
country_id: 3469034
description:
[2025-02-06 03:21:18 +0100] info [webmaild] 186.237.100.157 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 03:21:20 ait sshd[947341]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.166.74.70
country_id: 3625428
description:
[2025-02-06 03:21:55 +0100] info [webmaild] 38.166.74.70 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
country_id: 1562822
description:
Feb  6 03:21:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 03:21:58 ait sshd[947547]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-06 03:21:59 dovecot_plain authenticator failed for ([27.72.103.74]) [27.72.103.74]:58669: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
country_id: 3175395
description:
2025-02-06 03:21:40 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:53026: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.109.46.200
country_id: 2017370
description:
[2025-02-06 03:21:46 +0100] info [webmaild] 89.109.46.200 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
country_id: 3175395
description:
Feb  6 03:21:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-06 03:22:23 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:48378: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.35.226.158
country_id: 3175395
description:
Feb  6 03:22:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.35.226.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 03:23:00 ait sshd[947927]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
country_id: 1814991
description:
2025-02-06 03:22:03 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:61372: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
country_id: 6252001
description:
2025-02-06 03:22:16 dovecot_plain authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:33888: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  6 03:22:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.127.177.194
country_id: 6252001
description:
Feb  6 03:22:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.127.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.35.226.158
country_id: 3175395
description:
2025-02-06 03:22:56 dovecot_plain authenticator failed for (flurry) [193.35.226.158]:48500: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
country_id: 1269750
description:
2025-02-06 03:22:58 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:21713: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
country_id: 6252001
description:
Feb  6 03:22:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.113.66.20
country_id: 2635167
description:
Feb  6 03:22:27 ait sshd[947879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.113.66.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
country_id: 1269750
description:
Feb  6 03:22:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.94.3.171
country_id: 1814991
description:
Feb  6 03:22:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.94.3.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.94.3.171
country_id: 1814991
description:
2025-02-06 03:22:06 dovecot_plain authenticator failed for ([183.94.3.171]) [183.94.3.171]:44882: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-22.80.76.51.123


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 03:23:00 ait sshd[947927]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.63.42.76
country_id: 1814991
description:
Feb  6 03:22:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.63.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
country_id: 6252001
description:
2025-02-06 03:22:03 dovecot_plain authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:33135: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.113.66.20
country_id: 2635167
description:
Feb  6 03:22:27 ait sshd[947879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.113.66.20


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
country_id: 1814991
description:
2025-02-06 03:23:18 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:20080: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  6 03:23:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.8.167.241
country_id: 3469034
description:
2025-02-06 03:24:00 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:11956: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
country_id: 1814991
description:
2025-02-06 03:23:11 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:56156: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
country_id: 1269750
description:
Feb  6 03:23:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.6.195.234
country_id: 3469034
description:
[2025-02-06 03:23:47 +0100] info [webmaild] 189.6.195.234 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
country_id: 1835841
description:
Feb  6 03:23:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-02-06 03:23:25 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:37550: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
country_id: 3996063
description:
Feb  6 03:23:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 03:23:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
country_id: 1835841
description:
2025-02-06 03:23:09 dovecot_login authenticator failed for ([218.149.235.152]) [218.149.235.152]:34460: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.158.171.3
country_id: 1814991
description:
Feb  6 03:23:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.158.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
country_id: 1814991
description:
Feb  6 03:23:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
country_id: 3996063
description:
2025-02-06 03:23:48 dovecot_login authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:49877: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
country_id: 3469034
description:
Feb  6 03:23:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 03:23:03 ait sshd[947927]: Failed password for invalid user goudirect from 202.29.235.66 port 35918 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
country_id: 2542007
description:
Feb  6 03:23:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
country_id: 3469034
description:
Feb  6 03:23:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
country_id: 2542007
description:
2025-02-06 03:23:27 dovecot_plain authenticator failed for (deflueaed) [102.53.15.54]:47330: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
country_id: 2661886
description:
Feb  6 03:23:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-06 03:23:37 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:55965: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 03:23:56 ait sshd[948159]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-02-06 03:23:59 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:39450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
country_id: 2661886
description:
2025-02-06 03:23:31 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (whearyterd) [78.68.37.25]:49075: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 03:23:56 ait sshd[948159]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.175.110.3
country_id: 1814991
description:
Feb  6 03:24:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.175.110.3 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.222.71.23
country_id: 3469034
description:
[2025-02-06 03:24:34 +0100] info [webmaild] 186.222.71.23 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 03:24:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 03:24:37 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:55741: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 03:24:45 ait sshd[948394]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.175.110.3
country_id: 1814991
description:
2025-02-06 03:24:07 dovecot_login authenticator failed for ([222.175.110.3]) [222.175.110.3]:46580: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.225.134.13
country_id: 1835841
description:
Feb  6 03:24:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.225.134.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
country_id: 6252001
description:
Feb  6 03:24:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.225.134.13
country_id: 1835841
description:
2025-02-06 03:24:14 dovecot_login authenticator failed for ([182.225.134.13]) [182.225.134.13]:35036: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-02-06 03:24:15 dovecot_login authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:39658: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
country_id: 1814991
description:
Feb  6 03:24:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.160.121.131
country_id: 3469034
description:
[2025-02-06 03:24:16 +0100] info [webmaild] 45.160.121.131 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.57.60
country_id: 2510769
description:
Feb  6 03:24:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.57.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2025-02-06 03:24:24 dovecot_plain authenticator failed for ([85.152.57.60]) [85.152.57.60]:46781: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 03:24:45 ait sshd[948394]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
country_id: 1814991
description:
2025-02-06 03:24:53 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:40550: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 03:25:21 ait sshd[948751]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
country_id: 1835841
description:
Feb  6 03:25:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.85.69.22
country_id: 2017370
description:
Feb  6 03:25:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.85.69.22 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
country_id: 1814991
description:
Feb  6 03:25:33 ait sshd[948781]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2025-02-06 03:25:35 dovecot_login authenticator failed for (22.69.85.194.in-addr.arpa) [194.85.69.22]:49484: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.157.78
country_id: 6252001
description:
2025-02-06 03:25:03 dovecot_plain authenticator failed for c-73-0-157-78.hsd1.fl.comcast.net [73.0.157.78]:33786: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
country_id: 1814991
description:
2025-02-06 03:25:09 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:57976: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
country_id: 1814991
description:
Feb  6 03:25:33 ait sshd[948781]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
country_id: 1814991
description:
2025-02-06 03:25:19 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:46106: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
country_id: 1861060
description:
Feb  6 03:25:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-02-06 03:25:40 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:58362: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
country_id: 6252001
description:
Feb  6 03:26:00 ait sshd[948923]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
country_id: 1814991
description:
Feb  6 03:25:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.69
country_id: 1522867
description:
Feb  6 03:25:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
country_id: 1814991
description:
2025-02-06 03:25:32 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:57770: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
country_id: 2921044
description:
2025-02-06 03:25:12 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:37656: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
country_id: 1814991
description:
Feb  6 03:25:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
country_id: 1814991
description:
Feb  6 03:25:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.69
country_id: 1522867
description:
2025-02-06 03:25:32 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.69]:53464: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.20.181.253
country_id: 2802361
description:
2025-02-06 03:25:43 dovecot_plain authenticator failed for 78-20-181-253.access.telenet.be (quationd) [78.20.181.253]:43926: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 03:25:53 ait sshd[948897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.187.71  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.122.163
country_id: 1512440
description:
[2025-02-06 03:25:07 +0100] info [webmaild] 84.54.122.163 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
country_id: 2921044
description:
Feb  6 03:25:10 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 03:25:21 ait sshd[948751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
country_id: 1835841
description:
2025-02-06 03:25:26 dovecot_login authenticator failed for ([1.252.204.203]) [1.252.204.203]:60331: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
country_id: 1861060
description:
Feb  6 03:25:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.157.78
country_id: 6252001
description:
Feb  6 03:25:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.157.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-02-06 03:25:20 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:58956: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
country_id: 1861060
description:
2025-02-06 03:25:45 dovecot_plain authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.229]:16654: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 03:25:53 ait sshd[948897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.87.187.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Feb  6 03:25:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.20.181.253
country_id: 2802361
description:
Feb  6 03:25:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.20.181.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
country_id: 6252001
description:
Feb  6 03:26:00 ait sshd[948923]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.108.63.155
country_id: 1210997
description:
[2025-02-06 03:26:23 +0100] info [webmaild] 103.108.63.155 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.239.87.6
country_id: 6252001
description:
2025-02-06 03:26:35 dovecot_plain authenticator failed for (solan) [96.239.87.6]:59130: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  6 03:26:48 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 03:26:50 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:37953: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
country_id: 99237
description:
Feb  6 03:26:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
country_id: 1835841
description:
Feb  6 03:26:16 ait sshd[949104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
country_id: 6252001
description:
Feb  6 03:26:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
country_id: 1819730
description:
Feb  6 03:26:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
country_id: 1819730
description:
2025-02-06 03:26:40 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:43013: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 69.160.112.253
country_id: 3489940
description:
[2025-02-06 03:26:50 +0100] info [webmaild] 69.160.112.253 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
country_id: 1522867
description:
Feb  6 03:26:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
country_id: 6252001
description:
2025-02-06 03:27:01 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:59420: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-06 03:27:01 dovecot_plain authenticator failed for (forbulated) [109.166.70.166]:54366: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
country_id: 1835841
description:
Feb  6 03:26:16 ait sshd[949104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
country_id: 6252001
description:
Feb  6 03:26:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2025-02-06 03:26:58 dovecot_plain authenticator failed for (junaming) [65.20.149.93]:57053: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 03:27:06 ait sshd[949203]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
country_id: 1814991
description:
2025-02-06 03:27:46 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:14050: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 03:27:06 ait sshd[949203]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.229
country_id: 1814991
description:
Feb  6 03:27:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 03:27:41 ait sshd[949521]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.252.252
country_id: 3469034
description:
[2025-02-06 03:27:08 +0100] info [webmaild] 45.177.252.252 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.194.238.48
country_id: 2017370
description:
[2025-02-06 03:27:41 +0100] info [webmaild] 91.194.238.48 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 03:27:41 ait sshd[949521]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.229
country_id: 1814991
description:
2025-02-06 03:27:32 dovecot_plain authenticator failed for ([112.31.93.229]) [112.31.93.229]:40333: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
country_id: 1814991
description:
Feb  6 03:27:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
country_id: 1835841
description:
Feb  6 03:28:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.76.125
country_id: 3469034
description:
[2025-02-06 03:28:52 +0100] info [webmaild] 170.80.76.125 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
country_id: 1835841
description:
2025-02-06 03:28:39 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:49775: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.250.249.12
country_id: 1269750
description:
Feb  6 03:28:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.250.249.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-02-06 03:28:48 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:49630: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.33.246
country_id: 3469034
description:
[2025-02-06 03:29:20 +0100] info [webmaild] 177.87.33.246 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.113.74.46
country_id: 2635167
description:
Feb  6 03:29:41 ait sshd[950142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.113.74.46 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.113.74.46
country_id: 2635167
description:
Feb  6 03:29:41 ait sshd[950142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.113.74.46  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
country_id: 1814991
description:
Feb  6 03:29:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
country_id: 1814991
description:
2025-02-06 03:29:58 dovecot_plain authenticator failed for ([222.216.2.74]) [222.216.2.74]:51617: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 03:29:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.163.44.191
country_id: 3469034
description:
[2025-02-06 03:29:47 +0100] info [webmaild] 164.163.44.191 - feedback@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
country_id: 1835841
description:
Feb  6 03:30:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.219
country_id: 1814991
description:
Feb  6 03:30:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
country_id: 2635167
description:
2025-02-06 03:30:18 dovecot_plain authenticator failed for (arity) [185.65.238.250]:56473: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  6 03:30:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
country_id: 690791
description:
2025-02-06 03:30:43 dovecot_plain authenticator failed for (wobul) [37.139.110.118]:37093: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 03:30:46 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:52275: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.205
country_id: 1668284
description:
2025-02-06 03:30:47 dovecot_plain authenticator failed for 111-70-25-205.emome-ip.hinet.net [111.70.25.205]:56420: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: modsec
rule: 77220020
name: IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)
abuser: 191.101.122.7
country_id: 2921044
domain: worldwide-university.com
description:
IM360 WAF: DoS vulnerability in Apache 2.2.17 - 2.2.21 (CVE-2012-0021)||MVN:REQUEST_URI||MV:/||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.219
country_id: 1814991
description:
2025-02-06 03:30:13 dovecot_plain authenticator failed for ([60.31.181.219]) [60.31.181.219]:58391: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
country_id: 2635167
description:
Feb  6 03:30:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.52.13.157
country_id: 690791
description:
[2025-02-06 03:30:19 +0100] info [webmaild] 77.52.13.157 - feedback@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.205
country_id: 1668284
description:
Feb  6 03:30:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
country_id: 690791
description:
Feb  6 03:30:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
country_id: 1814991
description:
Feb  6 03:30:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
country_id: 1814991
description:
2025-02-06 03:30:57 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:55256: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
country_id: 1835841
description:
2025-02-06 03:30:33 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:46466: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
country_id: 174982
description:
Feb  6 03:31:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.188.139
country_id: 1814991
description:
Feb  6 03:31:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.188.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
country_id: 99237
description:
Feb  6 03:31:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.128.108
country_id: 1814991
description:
2025-02-06 03:31:20 dovecot_login authenticator failed for ([39.129.128.108]) [39.129.128.108]:48284: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.188.139
country_id: 1814991
description:
2025-02-06 03:31:32 dovecot_login authenticator failed for ([220.248.188.139]) [220.248.188.139]:56569: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 03:31:39 ait sshd[950766]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.54.195
country_id: 3469034
description:
[2025-02-06 03:31:50 +0100] info [webmaild] 138.185.54.195 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.24.100.27
country_id: 1814991
description:
Feb  6 03:31:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.24.100.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
country_id: 174982
description:
2025-02-06 03:31:53 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:59438: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.77.70
country_id: 6252001
description:
Feb  6 03:31:17 ait sshd[950731]: pam_imunify(sshd:auth): [IM360_RBL] The IP 132.148.77.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.24.100.27
country_id: 1814991
description:
2025-02-06 03:31:54 dovecot_login authenticator failed for ([183.24.100.27]) [183.24.100.27]:39971: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
country_id: 2661886
description:
2025-02-06 03:31:55 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (latest) [217.215.254.115]:60574: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.188.39.62
country_id: 3996063
description:
[2025-02-06 03:31:21 +0100] info [webmaild] 187.188.39.62 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.205
country_id: 99237
description:
2025-02-06 03:31:47 dovecot_plain authenticator failed for (ptifirodia) [65.20.155.205]:47295: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Feb  6 03:31:26 ait sshd[950740]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 03:31:39 ait sshd[950766]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
country_id: 2661886
description:
Feb  6 03:31:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 132.148.77.70
country_id: 6252001
description:
Feb  6 03:31:17 ait sshd[950731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=132.148.77.70  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.128.108
country_id: 1814991
description:
Feb  6 03:31:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.128.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
country_id: 1814991
description:
2025-02-06 03:32:07 dovecot_login authenticator failed for ([119.84.241.94]) [119.84.241.94]:52458: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.74.230.101
country_id: 1210997
description:
[2025-02-06 03:32:27 +0100] info [webmaild] 103.74.230.101 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.162.41.152
country_id: 3469034
description:
[2025-02-06 03:32:59 +0100] info [webmaild] 45.162.41.152 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
country_id: 1814991
description:
2025-02-06 03:32:04 dovecot_plain authenticator failed for ([183.237.33.162]) [183.237.33.162]:35614: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
country_id: 1814991
description:
Feb  6 03:32:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
country_id: 1814991
description:
Feb  6 03:32:02 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 03:32:05 ait sshd[950810]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.183.167.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 03:32:05 ait sshd[950810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.183.167.41  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
country_id: 1831722
description:
Feb  6 03:33:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
country_id: 2921044
description:
2025-02-06 03:33:22 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:61558: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.170
country_id: 6252001
description:
2025-02-06 03:33:25 dovecot_login authenticator failed for ([104.241.233.170]) [104.241.233.170]:38157: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
country_id: 6252001
description:
Feb  6 03:33:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
country_id: 6252001
description:
2025-02-06 03:33:08 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:32864: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
country_id: 3469034
description:
2025-02-06 03:34:00 dovecot_plain authenticator failed for ([200.141.225.73]) [200.149.54.14]:43827: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.196.240.38
country_id: 6252001
description:
Feb  6 03:34:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.196.240.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
country_id: 1831722
description:
2025-02-06 03:33:18 dovecot_plain authenticator failed for ([36.37.181.181]) [36.37.181.181]:57716: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.95.252
country_id: 3469034
description:
[2025-02-06 03:33:46 +0100] info [webmaild] 177.11.95.252 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
country_id: 3469034
description:
Feb  6 03:33:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
country_id: 2921044
description:
Feb  6 03:33:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
country_id: 1269750
description:
2025-02-06 03:33:31 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:57236: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.170
country_id: 6252001
description:
Feb  6 03:33:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
country_id: 1269750
description:
Feb  6 03:33:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  6 03:34:33 ait sshd[951619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.5.245.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
country_id: 1835841
description:
Feb  6 03:34:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
country_id: 1835841
description:
2025-02-06 03:34:10 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:35658: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.196.240.38
country_id: 6252001
description:
2025-02-06 03:34:03 dovecot_plain authenticator failed for ip72-196-240-38.dc.dc.cox.net (metion) [72.196.240.38]:42380: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.120.17.71
country_id: 3469034
description:
[2025-02-06 03:34:14 +0100] info [webmaild] 187.120.17.71 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  6 03:34:33 ait sshd[951619]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.5.245.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.239.251.214
country_id: 1835841
description:
Feb  6 03:34:38 ait sshd[951644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.239.251.214  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.77.189
country_id: 3686110
description:
[2025-02-06 03:34:53 +0100] info [webmaild] 181.78.77.189 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.73.188.213
country_id: 1269750
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:03-34.103.73.188.213


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.251.214
country_id: 1835841
description:
Feb  6 03:34:38 ait sshd[951644]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.239.251.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.109.27.194
country_id: 2017370
description:
Feb  6 03:35:42 ait sshd[952032]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.109.27.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.215
country_id: 6252001
description:
Feb  6 03:35:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.215
country_id: 6252001
description:
2025-02-06 03:35:49 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:58291: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.138.132.109
country_id: 1814991
description:
Feb  6 03:35:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.138.132.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 03:35:59 ait sshd[952048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.244.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.222.157.26
country_id: 3625428
description:
[2025-02-06 03:35:26 +0100] info [webmaild] 38.222.157.26 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.92.123.104
country_id: 1269750
description:
Feb  6 03:35:41 ait sshd[952022]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.92.123.104  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.109.27.194
country_id: 2017370
description:
Feb  6 03:35:42 ait sshd[952032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.109.27.194  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 03:35:59 ait sshd[952048]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.244.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.123.104
country_id: 1269750
description:
Feb  6 03:35:41 ait sshd[952022]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.92.123.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
country_id: 1814991
description:
2025-02-06 03:36:20 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:37008: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 03:36:38 ait sshd[952346]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
country_id: 2921044
description:
Feb  6 03:36:38 ait sshd[952346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.16.240.235
country_id: 3865483
description:
[2025-02-06 03:36:45 +0100] info [webmaild] 181.16.240.235 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 46.101.244.88
country_id: 2921044
description:
Feb  6 03:36:01 ait sshd[952048]: Failed password for invalid user goudirect from 46.101.244.88 port 42770 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
country_id: 1522867
description:
2025-02-06 03:36:15 dovecot_plain authenticator failed for (aunked) [109.166.70.166]:33436: 535 Incorrect authentication data (set_id=ads22b22265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 03:36:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
country_id: 6251999
description:
2025-02-06 03:36:33 dovecot_plain authenticator failed for ([192.199.57.220]) [192.199.57.220]:34703: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.138.132.109
country_id: 1814991
description:
2025-02-06 03:36:01 dovecot_plain authenticator failed for ([36.138.132.109]) [36.138.132.109]:47222: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 03:36:46 ait sshd[952351]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.47.90.222
country_id: 3865483
description:
[2025-02-06 03:36:16 +0100] info [webmaild] 181.47.90.222 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.41.197.10
country_id: 1814991
description:
Feb  6 03:36:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.41.197.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.57.220
country_id: 6251999
description:
Feb  6 03:36:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.57.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 03:36:46 ait sshd[952351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
country_id: 1522867
description:
Feb  6 03:36:13 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-37.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
country_id: 1835841
description:
2025-02-06 03:37:31 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:34782: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.39.70.226
country_id: 732800
description:
[2025-02-06 03:37:55 +0100] info [webmaild] 212.39.70.226 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
country_id: 1835841
description:
Feb  6 03:37:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-02-06 03:37:14 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:34986: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.168.84
country_id: 3865483
description:
[2025-02-06 03:37:21 +0100] info [webmaild] 143.0.168.84 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
country_id: 1835841
description:
Feb  6 03:37:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 03:38:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.188.185.67
country_id: 3865483
description:
[2025-02-06 03:38:48 +0100] info [webmaild] 190.188.185.67 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.199.57.220
country_id: 6251999
description:
Feb  6 03:38:08 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.199.57.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
country_id: 6252001
description:
Feb  6 03:38:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 03:38:21 ait sshd[953018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-02-06 03:38:24 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:49530: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.185
country_id: 2635167
description:
Feb  6 03:38:57 ait sshd[953121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.199.57.220
country_id: 6251999
description:
2025-02-06 03:38:10 dovecot_plain authenticator failed for ([192.199.57.220]) [192.199.57.220]:37041: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
country_id: 1814991
description:
Feb  6 03:38:21 ait sshd[953018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.185
country_id: 2635167
description:
Feb  6 03:38:57 ait sshd[953121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
country_id: 1814991
description:
2025-02-06 03:39:38 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:46116: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
country_id: 690791
description:
Feb  6 03:39:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.173.207.5
country_id: 831053
description:
[2025-02-06 03:39:16 +0100] info [webmaild] 185.173.207.5 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  6 03:39:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-06 03:39:20 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:37269: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
country_id: 3469034
description:
Feb  6 03:39:33 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
country_id: 1814991
description:
Feb  6 03:39:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
country_id: 1835841
description:
Feb  6 03:39:23 ait sshd[953318]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.167.42
country_id: 1605651
description:
2025-02-06 03:39:26 dovecot_plain authenticator failed for ppp-210-86-167-42.revip.asianet.co.th [210.86.167.42]:54089: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
country_id: 1835841
description:
2025-02-06 03:39:38 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:34092: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.22.55
country_id: 3469034
description:
2025-02-06 03:39:46 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:40545: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
country_id: 1835841
description:
Feb  6 03:39:23 ait sshd[953318]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
country_id: 1835841
description:
Feb  6 03:39:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.22.55
country_id: 3469034
description:
Feb  6 03:39:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.22.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
country_id: 690791
description:
2025-02-06 03:39:11 dovecot_plain authenticator failed for (noossistal) [37.139.110.118]:38172: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-02-06 03:39:14 dovecot_plain authenticator failed for (tretackle) [102.53.15.56]:33030: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.167.42
country_id: 1605651
description:
Feb  6 03:39:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.167.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-02-06 03:39:30 dovecot_plain authenticator failed for (ophanona) [46.30.161.197]:46664: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-02-06 03:39:35 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:46308: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Feb  6 03:39:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
country_id: 6252001
description:
Feb  6 03:39:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
country_id: 6252001
description:
2025-02-06 03:39:17 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:57106: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
country_id: 690791
description:
Feb  6 03:39:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.161.217.32
country_id: 3469034
description:
[2025-02-06 03:39:53 +0100] info [webmaild] 177.161.217.32 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.103.235.223
country_id: 1835841
description:
Feb  6 03:39:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.103.235.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.103.235.223
country_id: 1835841
description:
2025-02-06 03:39:32 dovecot_plain authenticator failed for ([222.103.235.223]) [222.103.235.223]:39142: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.113.3.87
country_id: 1269750
description:
Feb  6 03:39:52 ait sshd[953502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.113.3.87  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 03:40:05 ait sshd[953512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
country_id: 2542007
description:
Feb  6 03:40:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.232.177.74
country_id: 3469034
description:
[2025-02-06 03:40:35 +0100] info [webmaild] 186.232.177.74 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
country_id: 1835841
description:
Feb  6 03:40:05 ait sshd[953512]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
country_id: 3175395
description:
Feb  6 03:40:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
country_id: 3144096
description:
Feb  6 03:40:19 ait sshd[953702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
country_id: 3175395
description:
2025-02-06 03:40:24 dovecot_plain authenticator failed for net-130-0-149-238.cust.vodafonedsl.it (monaeakly) [130.0.149.238]:49526: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2025-02-06 03:40:27 dovecot_plain authenticator failed for (preinon) [102.53.15.56]:39923: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.209
country_id: 1814991
description:
Feb  6 03:41:15 ait sshd[953999]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.209  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
country_id: 2077456
description:
Feb  6 03:41:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.209
country_id: 1814991
description:
Feb  6 03:41:15 ait sshd[953999]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.209 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  6 03:41:23 ait sshd[954043]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 03:41:29 ait sshd[954176]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.191.88.29  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.191.88.29
country_id: 1562822
description:
Feb  6 03:41:29 ait sshd[954176]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.191.88.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.213.236.66
country_id: 6252001
description:
Feb  6 03:41:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.213.236.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.213.236.66
country_id: 6252001
description:
2025-02-06 03:41:09 dovecot_plain authenticator failed for c-73-213-236-66.hsd1.va.comcast.net (gentic) [73.213.236.66]:34286: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.183.157.224
country_id: 3469034
description:
[2025-02-06 03:41:31 +0100] info [webmaild] 179.183.157.224 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.134.217.51
country_id: 1282988
description:
[2025-02-06 03:41:59 +0100] info [webmaild] 103.134.217.51 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
country_id: 2077456
description:
Feb  6 03:42:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  6 03:42:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-06 03:42:30 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:35411: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
country_id: 6252001
description:
Feb  6 03:42:39 ait sshd[954471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.177.66
country_id: 1814991
description:
2025-02-06 03:42:16 dovecot_plain authenticator failed for ([112.98.177.66]) [112.98.177.66]:43624: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.250.17.240
country_id: 690791
description:
[2025-02-06 03:42:28 +0100] info [webmaild] 46.250.17.240 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.30.150.166
country_id: 1835841
description:
Feb  6 03:42:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.30.150.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
country_id: 1835841
description:
Feb  6 03:42:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.98.177.66
country_id: 1814991
description:
Feb  6 03:42:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.98.177.66 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 209.17.114.78
country_id: 6252001
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:03-42.209.17.114.78


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
country_id: 1831722
description:
Feb  6 03:42:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
country_id: 1835841
description:
2025-02-06 03:42:14 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:47406: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.240.204.168
country_id: 2077456
description:
Feb  6 03:42:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.240.204.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.204.168
country_id: 2077456
description:
2025-02-06 03:42:30 dovecot_plain authenticator failed for 60-240-204-168.static.tpgi.com.au [60.240.204.168]:44183: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 03:42:35 ait sshd[954462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
country_id: 2017370
description:
Feb  6 03:43:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.218
country_id: 3865483
description:
Feb  6 03:43:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
country_id: 1814991
description:
2025-02-06 03:43:49 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:55914: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.228
country_id: 99237
description:
Feb  6 03:43:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.228 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.203.218.69
country_id: 6252001
description:
[2025-02-06 03:43:28 +0100] info [cpaneld] 185.203.218.69 - lemsas "GET /execute/Email/list_pops?api.version=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.228
country_id: 99237
description:
2025-02-06 03:43:32 dovecot_plain authenticator failed for (pancons) [65.20.160.228]:48838: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
country_id: 3865483
description:
2025-02-06 03:43:38 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:40863: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
country_id: 1831722
description:
Feb  6 03:43:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
country_id: 1814991
description:
Feb  6 03:43:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 03:43:50 ait sshd[954929]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
country_id: 6251999
description:
Feb  6 03:43:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
country_id: 6251999
description:
2025-02-06 03:43:59 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:41028: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.141.175.170
country_id: 1210997
description:
[2025-02-06 03:43:03 +0100] info [webmaild] 103.141.175.170 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 03:43:50 ait sshd[954929]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
country_id: 2017370
description:
2025-02-06 03:43:34 dovecot_plain authenticator failed for (jarthes) [89.175.253.49]:49112: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.59.94.130
country_id: 1269750
description:
Feb  6 03:44:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.59.94.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.78.54.23
country_id: 3865483
description:
[2025-02-06 03:44:32 +0100] info [webmaild] 149.78.54.23 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
country_id: 614540
description:
Feb  6 03:44:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
country_id: 2017370
description:
2025-02-06 03:44:58 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:50678: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.59.94.130
country_id: 1269750
description:
2025-02-06 03:44:08 dovecot_plain authenticator failed for (rw-00130-94.59.137.rcil.gov.in) [137.59.94.130]:52506: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
country_id: 2264397
description:
2025-02-06 03:44:49 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:49254: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-02-06 03:44:49 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:64856: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.145.163.164
country_id: 1814991
description:
Feb  6 03:44:54 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.145.163.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
country_id: 3017382
description:
Feb  6 03:44:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
country_id: 2017370
description:
Feb  6 03:44:56 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.145.163.164
country_id: 1814991
description:
2025-02-06 03:44:56 dovecot_plain authenticator failed for ([61.145.163.164]) [61.145.163.164]:54098: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
country_id: 2264397
description:
Feb  6 03:44:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
country_id: 1835841
description:
Feb  6 03:44:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
country_id: 1835841
description:
2025-02-06 03:44:53 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:41256: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.21.152.217
country_id: 3469034
description:
[2025-02-06 03:44:01 +0100] info [webmaild] 201.21.152.217 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.10.53.109
country_id: 1562822
description:
Feb  6 03:44:46 ait sshd[955144]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.10.53.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.10.53.109
country_id: 1562822
description:
Feb  6 03:44:46 ait sshd[955144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.10.53.109


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
country_id: 3017382
description:
2025-02-06 03:44:59 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:57460: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-06 03:45:45 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:53537: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
country_id: 1814991
description:
2025-02-06 03:45:06 dovecot_plain authenticator failed for ([61.184.176.231]) [61.184.176.231]:42673: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.126.227
country_id: 3469034
description:
[2025-02-06 03:45:38 +0100] info [webmaild] 177.39.126.227 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
country_id: 1269750
description:
Feb  6 03:45:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  6 03:45:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
country_id: 1880251
description:
Feb  6 03:45:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.53.86
country_id: 1880251
description:
47.128.53.86 - - [06/Feb/2025:03:45:39 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16339632 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/open/index.php?Itemid=299&id=147&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.53.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
country_id: 1814991
description:
Feb  6 03:45:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-06 03:45:11 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:49457: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
country_id: 1814991
description:
Feb  6 03:45:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.3.178.94
country_id: 3175395
description:
2025-02-06 03:45:51 dovecot_login authenticator failed for ([151.3.178.94]) [151.3.178.94]:44536: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.3.178.94
country_id: 3175395
description:
Feb  6 03:45:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.3.178.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
country_id: 1814991
description:
Feb  6 03:45:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
country_id: 1814991
description:
Feb  6 03:45:05 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  6 03:45:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2025-02-06 03:45:11 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:39480: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
country_id: 614540
description:
2025-02-06 03:45:37 dovecot_plain authenticator failed for ([185.207.129.246]) [185.207.129.246]:42642: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
country_id: 1880251
description:
2025-02-06 03:45:32 dovecot_plain authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:38097: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.67
country_id: 1814991
description:
2025-02-06 03:45:40 dovecot_login authenticator failed for ([111.61.176.67]) [111.61.176.67]:53876: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
country_id: 6252001
description:
Feb  6 03:45:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
country_id: 614540
description:
Feb  6 03:45:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
country_id: 1269750
description:
2025-02-06 03:45:41 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:55822: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.194.60
country_id: 3469034
description:
[2025-02-06 03:45:06 +0100] info [webmaild] 177.73.194.60 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
country_id: 6252001
description:
2025-02-06 03:45:05 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:43137: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2025-02-06 03:45:07 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:57980: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  6 03:45:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-06 03:45:25 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:34048: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
country_id: 2661886
description:
2025-02-06 03:46:40 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:40800: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.22.55
country_id: 3469034
description:
2025-02-06 03:46:19 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:42847: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.183.246
country_id: 2017370
description:
2025-02-06 03:46:26 dovecot_plain authenticator failed for (relay1.irkmw.ru) [195.239.183.246]:55136: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.185
country_id: 1814991
description:
2025-02-06 03:46:33 dovecot_plain authenticator failed for ([220.180.171.185]) [220.180.171.185]:44285: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
country_id: 1861060
description:
Feb  6 03:46:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
country_id: 2661886
description:
2025-02-06 03:46:16 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:60274: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.13.243.101
country_id: 2264397
description:
Feb  6 03:46:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.13.243.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.213.120.109
country_id: 1861060
description:
Feb  6 03:46:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.213.120.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.203.122.112
country_id: 6252001
description:
Feb  6 03:46:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.203.122.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
country_id: 2750405
description:
2025-02-06 03:46:43 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:39756: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
country_id: 1814991
description:
2025-02-06 03:46:48 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:43178: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.251.121.70
country_id: 1861060
description:
Feb  6 03:46:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.251.121.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.211.125
country_id: 1814991
description:
2025-02-06 03:46:21 dovecot_plain authenticator failed for ([113.64.211.125]) [113.64.211.125]:48818: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.17.125.28
country_id: 1814991
description:
Feb  6 03:46:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.17.125.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.202.94.224
country_id: 390903
description:
Feb  6 03:46:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.202.94.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
country_id: 1814991
description:
2025-02-06 03:46:31 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:56790: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.56
country_id: 2017370
description:
Feb  6 03:46:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
country_id: 2017370
description:
Feb  6 03:46:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
country_id: 1814991
description:
2025-02-06 03:46:26 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:41764: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-02-06 03:46:27 dovecot_plain authenticator failed for ([185.101.16.250]) [185.101.16.250]:38096: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
country_id: 1562822
description:
Feb  6 03:46:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.144.90
country_id: 1835841
description:
2025-02-06 03:46:41 dovecot_plain authenticator failed for ([114.30.144.90]) [114.30.144.90]:39437: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
country_id: 1835841
description:
Feb  6 03:46:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
country_id: 6252001
description:
Feb  6 03:46:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2025-02-06 03:46:36 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:42340: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
country_id: 1562822
description:
2025-02-06 03:46:42 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:37463: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.207
country_id: 3865483
description:
2025-02-06 03:46:21 dovecot_plain authenticator failed for ([167.250.119.207]) [167.250.119.207]:46817: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.221.96
country_id: 3469034
description:
[2025-02-06 03:46:26 +0100] info [webmaild] 45.165.221.96 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.192
country_id: 2017370
description:
Feb  6 03:46:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
country_id: 294640
description:
Feb  6 03:46:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
country_id: 3017382
description:
2025-02-06 03:46:42 dovecot_plain authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:57334: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
country_id: 2510769
description:
Feb  6 03:46:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  6 03:46:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.22.55
country_id: 3469034
description:
Feb  6 03:46:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.22.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.207.132.29
country_id: 1814991
description:
2025-02-06 03:46:23 dovecot_plain authenticator failed for ([218.207.132.29]) [218.207.132.29]:32795: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.17.125.28
country_id: 1814991
description:
2025-02-06 03:46:25 dovecot_plain authenticator failed for ([120.55.170.138]) [183.17.125.28]:5449: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-02-06 03:46:38 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:47818: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2025-02-06 03:46:27 dovecot_plain authenticator failed for ([85.159.164.28]) [85.159.164.28]:36656: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2025-02-06 03:46:37 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:46408: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
country_id: 149590
description:
2025-02-06 03:46:51 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:51138: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
country_id: 2510769
description:
Feb  6 03:46:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
country_id: 1880251
description:
Feb  6 03:46:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.88.91.22
country_id: 6252001
description:
2025-02-06 03:46:19 dovecot_plain authenticator failed for syn-097-088-091-022.res.spectrum.com [97.88.91.22]:38049: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
country_id: 1814991
description:
Feb  6 03:46:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
country_id: 1814991
description:
2025-02-06 03:46:33 dovecot_plain authenticator failed for ([36.26.63.158]) [36.26.63.158]:35360: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.143.231.208
country_id: 1814991
description:
2025-02-06 03:46:34 dovecot_plain authenticator failed for ([43.143.231.208]) [43.143.231.208]:42016: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.227.31.71
country_id: 2017370
description:
Feb  6 03:46:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.227.31.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.229.19.137
country_id: 3865483
description:
Feb  6 03:46:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.229.19.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-02-06 03:46:17 dovecot_plain authenticator failed for ([83.136.176.12]) [83.136.176.12]:42293: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
country_id: 1814991
description:
Feb  6 03:46:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
country_id: 6251999
description:
Feb  6 03:46:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
country_id: 6251999
description:
2025-02-06 03:46:23 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:53682: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
country_id: 1814991
description:
Feb  6 03:46:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-02-06 03:46:36 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:59136: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
country_id: 290557
description:
Feb  6 03:46:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-02-06 03:46:52 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:54698: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
country_id: 2017370
description:
2025-02-06 03:46:27 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:50900: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Feb  6 03:46:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
country_id: 1814991
description:
2025-02-06 03:46:38 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:56604: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
country_id: 3017382
description:
Feb  6 03:46:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.244.83.178
country_id: 2661886
description:
Feb  6 03:46:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.244.83.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.62
country_id: 2077456
description:
Feb  6 03:46:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.207.132.29
country_id: 1814991
description:
Feb  6 03:46:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.207.132.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
country_id: 690791
description:
Feb  6 03:46:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
country_id: 290557
description:
2025-02-06 03:46:44 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:33019: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.104.122.159
country_id: 6251999
description:
Feb  6 03:46:35 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.104.122.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
country_id: 1814991
description:
2025-02-06 03:46:38 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:33722: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  6 03:46:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.251.121.70
country_id: 1861060
description:
2025-02-06 03:46:21 dovecot_plain authenticator failed for works.ssc-gr.info [160.251.121.70]:40324: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
country_id: 1835841
description:
2025-02-06 03:46:32 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:36798: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
country_id: 390903
description:
2025-02-06 03:46:34 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:59934: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.63.175
country_id: 1814991
description:
2025-02-06 03:46:20 dovecot_plain authenticator failed for ([182.135.63.175]) [182.135.63.175]:54328: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
country_id: 1819730
description:
Feb  6 03:46:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.18.252.107
country_id: 1814991
description:
2025-02-06 03:46:42 dovecot_plain authenticator failed for ([14.18.252.107]) [14.18.252.107]:43830: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.89
country_id: 2017370
description:
2025-02-06 03:47:01 dovecot_plain authenticator failed for ([5.166.68.89]) [5.166.68.89]:57690: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Feb  6 03:46:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.62
country_id: 2077456
description:
2025-02-06 03:46:19 dovecot_plain authenticator failed for ([203.189.124.62]) [203.189.124.62]:57160: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
country_id: 1814991
description:
Feb  6 03:46:21 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
country_id: 1814991
description:
Feb  6 03:46:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.97.90.143
country_id: 1814991
description:
Feb  6 03:46:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.97.90.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-06 03:46:51 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:34099: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-02-06 03:46:23 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:55058: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
country_id: 1861060
description:
Feb  6 03:46:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
country_id: 1814991
description:
Feb  6 03:46:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
country_id: 2661886
description:
Feb  6 03:46:38 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
country_id: 1668284
description:
Feb  6 03:46:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.238.192.121
country_id: 2750405
description:
Feb  6 03:46:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.238.192.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
country_id: 1269750
description:
2025-02-06 03:46:19 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:46816: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
country_id: 1814991
description:
2025-02-06 03:46:20 dovecot_plain authenticator failed for ([60.173.114.254]) [60.173.114.254]:38446: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
country_id: 3865483
description:
2025-02-06 03:46:25 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:50376: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
country_id: 1819730
description:
2025-02-06 03:46:31 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:42567: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
country_id: 298795
description:
Feb  6 03:46:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
country_id: 1835841
description:
Feb  6 03:46:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-02-06 03:46:32 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:54504: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
country_id: 6252001
description:
Feb  6 03:46:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.236.91.93
country_id: 1814991
description:
Feb  6 03:46:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.236.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.236.91.93
country_id: 1814991
description:
2025-02-06 03:46:19 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [42.236.91.93]:43188: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
country_id: 294640
description:
Feb  6 03:46:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.102
country_id: 1861060
description:
Feb  6 03:46:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.185
country_id: 1814991
description:
Feb  6 03:46:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.209.153
country_id: 1814991
description:
2025-02-06 03:46:30 dovecot_plain authenticator failed for ([39.174.209.153]) [39.174.209.153]:43621: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.143.231.208
country_id: 1814991
description:
Feb  6 03:46:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.143.231.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
country_id: 1814991
description:
Feb  6 03:46:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
country_id: 1814991
description:
2025-02-06 03:46:23 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:52043: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
country_id: 3865483
description:
Feb  6 03:46:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
country_id: 1814991
description:
Feb  6 03:46:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Feb  6 03:46:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
country_id: 1814991
description:
Feb  6 03:46:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.203.122.112
country_id: 6252001
description:
2025-02-06 03:46:48 dovecot_plain authenticator failed for syn-069-203-122-112.res.spectrum.com [69.203.122.112]:47235: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.30.144.90
country_id: 1835841
description:
Feb  6 03:46:39 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.30.144.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
country_id: 1880251
description:
2025-02-06 03:46:45 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:46200: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.137
country_id: 1819730
description:
2025-02-06 03:46:54 dovecot_plain authenticator failed for 137.173.198.203.static.netvigator.com (145.173.198.203.static.netvigator.com) [203.198.173.137]:52830: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
country_id: 1835841
description:
2025-02-06 03:46:22 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:55558: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.158.171.3
country_id: 1814991
description:
Feb  6 03:46:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.158.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
country_id: 1814991
description:
Feb  6 03:46:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.213.120.109
country_id: 1861060
description:
2025-02-06 03:46:37 dovecot_plain authenticator failed for j120109.ppp.asahi-net.or.jp [61.213.120.109]:49734: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-02-06 03:46:16 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:60450: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.24.37.133
country_id: 6251999
description:
2025-02-06 03:46:24 dovecot_plain authenticator failed for (192-24-37-133.nftctelecom.com) [192.24.37.133]:36303: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2025-02-06 03:46:26 dovecot_plain authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:47017: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
country_id: 290557
description:
Feb  6 03:46:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.18.252.107
country_id: 1814991
description:
Feb  6 03:46:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.18.252.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
country_id: 2017370
description:
2025-02-06 03:46:21 dovecot_plain authenticator failed for ([178.178.222.56]) [178.178.222.56]:38124: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
country_id: 1814991
description:
2025-02-06 03:46:28 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:56552: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.141.177.55
country_id: 6251999
description:
Feb  6 03:46:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.141.177.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
country_id: 1668284
description:
2025-02-06 03:46:36 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:41104: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.13.243.101
country_id: 2264397
description:
2025-02-06 03:46:30 dovecot_plain authenticator failed for bl3-243-101.dsl.telepac.pt [213.13.243.101]:4786: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.229.19.137
country_id: 3865483
description:
2025-02-06 03:46:37 dovecot_plain authenticator failed for ([45.229.19.137]) [45.229.19.137]:52414: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.227.31.71
country_id: 2017370
description:
2025-02-06 03:46:37 dovecot_plain authenticator failed for ([91.227.31.71]) [91.227.31.71]:33682: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
country_id: 290557
description:
2025-02-06 03:46:47 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:46284: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
country_id: 1814991
description:
Feb  6 03:46:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.207
country_id: 3865483
description:
Feb  6 03:46:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
country_id: 1814991
description:
Feb  6 03:46:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.209.153
country_id: 1814991
description:
Feb  6 03:46:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
country_id: 1814991
description:
Feb  6 03:46:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.243.68.66
country_id: 1861060
description:
2025-02-06 03:46:25 dovecot_plain authenticator failed for 66.68.243.35.bc.googleusercontent.com [35.243.68.66]:38182: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.128.211
country_id: 1814991
description:
2025-02-06 03:46:28 dovecot_plain authenticator failed for ([112.27.128.211]) [112.27.128.211]:34654: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.102
country_id: 1861060
description:
2025-02-06 03:46:32 dovecot_plain authenticator failed for st7014.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.102]:60860: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
country_id: 1880251
description:
2025-02-06 03:46:19 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:33343: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.211.125
country_id: 1814991
description:
Feb  6 03:46:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.211.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
country_id: 272103
description:
Feb  6 03:46:25 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.161.59
country_id: 3469034
description:
[2025-02-06 03:46:56 +0100] info [webmaild] 131.72.161.59 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.172.61.145
country_id: 1814991
description:
2025-02-06 03:46:22 dovecot_plain authenticator failed for ([39.172.61.145]) [39.172.61.145]:45607: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.177.55
country_id: 6251999
description:
2025-02-06 03:46:33 dovecot_plain authenticator failed for ([209.141.177.55]) [209.141.177.55]:56030: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
country_id: 6252001
description:
Feb  6 03:46:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
country_id: 1819730
description:
2025-02-06 03:46:54 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:53584: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.172.61.145
country_id: 1814991
description:
Feb  6 03:46:20 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.172.61.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.97.90.143
country_id: 1814991
description:
2025-02-06 03:46:41 dovecot_plain authenticator failed for ([180.97.90.143]) [180.97.90.143]:38852: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-06 03:46:43 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:59434: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-02-06 03:46:29 dovecot_plain authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:49880: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.104.122.159
country_id: 6251999
description:
2025-02-06 03:46:37 dovecot_plain authenticator failed for host-216-104-122-159.public.eastlink.ca [216.104.122.159]:55957: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-02-06 03:46:39 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:60468: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.173.137
country_id: 1819730
description:
Feb  6 03:46:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.173.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.207.241.168
country_id: 2245662
description:
Feb  6 03:46:14 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.207.241.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.136.195.32
country_id: 1814991
description:
2025-02-06 03:46:21 dovecot_plain authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:48126: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.24.37.133
country_id: 6251999
description:
Feb  6 03:46:22 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.24.37.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.206.42
country_id: 1814991
description:
2025-02-06 03:46:23 dovecot_plain authenticator failed for ([122.227.206.42]) [122.227.206.42]:57458: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.241.168
country_id: 2245662
description:
2025-02-06 03:46:16 dovecot_plain authenticator failed for ([196.207.241.168]) [196.207.241.168]:53989: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-02-06 03:46:19 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:43110: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
country_id: 3017382
description:
Feb  6 03:46:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
country_id: 149590
description:
Feb  6 03:46:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.239.183.246
country_id: 2017370
description:
Feb  6 03:46:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.239.183.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.88.91.22
country_id: 6252001
description:
Feb  6 03:46:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.88.91.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
country_id: 1269750
description:
Feb  6 03:46:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.63.175
country_id: 1814991
description:
Feb  6 03:46:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.63.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-02-06 03:46:19 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:39996: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
country_id: 1880251
description:
Feb  6 03:46:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-02-06 03:46:47 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:55218: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
country_id: 1819730
description:
Feb  6 03:46:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.89
country_id: 2017370
description:
Feb  6 03:46:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.136.195.32
country_id: 1814991
description:
Feb  6 03:46:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.136.195.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-06 03:46:20 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:58346: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
country_id: 1814991
description:
2025-02-06 03:46:21 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:51471: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
country_id: 298795
description:
2025-02-06 03:46:32 dovecot_plain authenticator failed for (95.0.252.72.static.ttnet.com.tr) [95.0.252.72]:39914: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
country_id: 1835841
description:
Feb  6 03:47:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
country_id: 1835841
description:
2025-02-06 03:47:11 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:55851: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 03:47:24 ait sshd[955960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.76
country_id: 1814991
description:
Feb  6 03:47:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.76
country_id: 1814991
description:
2025-02-06 03:47:32 dovecot_plain authenticator failed for (76.89.132.112.adsl-pool.ah.cnuninet.net) [112.132.89.76]:52711: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.108.210
country_id: 3658394
description:
[2025-02-06 03:47:38 +0100] info [webmaild] 157.100.108.210 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.170.62
country_id: 3469034
description:
[2025-02-06 03:48:10 +0100] info [webmaild] 45.228.170.62 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.140.69
country_id: 99237
description:
Feb  6 03:48:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.140.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.140.69
country_id: 99237
description:
2025-02-06 03:48:29 dovecot_plain authenticator failed for (blegle) [65.20.140.69]:37488: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
country_id: 1814991
description:
Feb  6 03:48:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 03:48:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.154.142.4
country_id: 286963
description:
[2025-02-06 03:48:57 +0100] info [webmaild] 85.154.142.4 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.155.212.8
country_id: 1168579
description:
[2025-02-06 03:49:26 +0100] info [webmaild] 119.155.212.8 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.163.103
country_id: 99237
description:
Feb  6 03:49:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.163.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2025-02-06 03:49:43 dovecot_plain authenticator failed for (oubinar) [65.20.163.103]:55088: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.25.73.199
country_id: 2921044
description:
Feb  6 03:49:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.25.73.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
country_id: 1269750
description:
2025-02-06 03:49:26 dovecot_login authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:34008: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.43.144.178
country_id: 2635167
description:
Feb  6 03:49:35 ait sshd[956806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.43.144.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.86.36
country_id: 1835841
description:
2025-02-06 03:49:53 dovecot_plain authenticator failed for ([118.36.86.36]) [118.36.86.36]:56611: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.25.73.199
country_id: 2921044
description:
2025-02-06 03:49:05 dovecot_login authenticator failed for ipb21949c7.dynamic.kabel-deutschland.de [178.25.73.199]:33419: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  6 03:49:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
country_id: 1269750
description:
Feb  6 03:49:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.43.144.178
country_id: 2635167
description:
Feb  6 03:49:35 ait sshd[956806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.43.144.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.86.36
country_id: 1835841
description:
Feb  6 03:49:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.86.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-06 03:49:55 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:58246: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.229
country_id: 1814991
description:
2025-02-06 03:50:26 dovecot_plain authenticator failed for ([112.31.93.229]) [112.31.93.229]:39795: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.132.203.101
country_id: 298795
description:
[2025-02-06 03:50:42 +0100] info [webmaild] 188.132.203.101 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
country_id: 2378080
description:
Feb  6 03:50:03 ait sshd[957037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2025-02-06 03:50:06 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:33652: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.222.190.80
country_id: 3469034
description:
[2025-02-06 03:50:10 +0100] info [webmaild] 179.222.190.80 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
country_id: 1814991
description:
Feb  6 03:50:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.141.105.6
country_id: 1814991
description:
2025-02-06 03:50:51 dovecot_plain authenticator failed for (6.105.141.116.adsl-pool.jlccptt.net.cn) [116.141.105.6]:46108: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
country_id: 953987
description:
Feb  6 03:50:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
country_id: 953987
description:
2025-02-06 03:50:13 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:40836: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.145
country_id: 1668284
description:
2025-02-06 03:50:28 dovecot_plain authenticator failed for 111-70-28-145.emome-ip.hinet.net [111.70.28.145]:33036: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.141.105.6
country_id: 1814991
description:
Feb  6 03:50:49 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.141.105.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
country_id: 1814991
description:
2025-02-06 03:50:28 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:35274: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
country_id: 1814991
description:
2025-02-06 03:50:32 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:17954: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
country_id: 1668284
description:
Feb  6 03:50:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
country_id: 6251999
description:
2025-02-06 03:50:14 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:41684: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-02-06 03:50:17 dovecot_plain authenticator failed for ([203.172.213.166]) [203.172.213.166]:53824: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.28.145
country_id: 1668284
description:
Feb  6 03:50:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.28.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.93.229
country_id: 1814991
description:
Feb  6 03:50:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.93.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
country_id: 1814991
description:
Feb  6 03:50:26 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.120.40
country_id: 1814991
description:
Feb  6 03:50:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.120.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
country_id: 6251999
description:
Feb  6 03:50:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
country_id: 1605651
description:
Feb  6 03:50:15 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
country_id: 1814991
description:
2025-02-06 03:50:18 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:41774: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
country_id: 3469034
description:
Feb  6 03:51:23 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.83.237
country_id: 6252001
description:
Feb  6 03:51:24 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.83.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
country_id: 3469034
description:
2025-02-06 03:51:25 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:58064: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.210.141.228
country_id: 294640
description:
[2025-02-06 03:51:53 +0100] info [webmaild] 46.210.141.228 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.136.24
country_id: 1814991
description:
Feb  6 03:51:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.136.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.136.24
country_id: 1814991
description:
2025-02-06 03:51:09 dovecot_plain authenticator failed for ([218.206.136.24]) [218.206.136.24]:55096: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
country_id: 1282988
description:
Feb  6 03:51:36 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
country_id: 1282988
description:
2025-02-06 03:51:38 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:44918: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.6.54
country_id: 3469034
description:
[2025-02-06 03:51:24 +0100] info [webmaild] 45.174.6.54 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
country_id: 6252001
description:
2025-02-06 03:51:26 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:34638: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.114.108.124
country_id: 3923057
description:
[2025-02-06 03:52:48 +0100] info [webmaild] 181.114.108.124 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
country_id: 1269750
description:
Feb  6 03:52:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
country_id: 2921044
description:
Feb  6 03:53:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
country_id: 3077311
description:
Feb  6 03:52:03 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
country_id: 6252001
description:
2025-02-06 03:52:21 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:58913: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.216.120.234
country_id: 6252001
description:
Feb  6 03:52:40 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.216.120.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
country_id: 3077311
description:
2025-02-06 03:52:05 dovecot_plain authenticator failed for (videoifolder.ru) [78.108.186.10]:58270: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
country_id: 6252001
description:
Feb  6 03:52:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
country_id: 6252001
description:
2025-02-06 03:52:18 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:52541: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
country_id: 1880251
description:
Feb  6 03:52:31 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-02-06 03:52:33 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:39002: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 03:52:51 ait sshd[957915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-02-06 03:52:54 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:32772: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
country_id: 3469034
description:
Feb  6 03:52:06 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
country_id: 1835841
description:
2025-02-06 03:52:13 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:56306: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
country_id: 1835841
description:
Feb  6 03:52:11 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
country_id: 6252001
description:
Feb  6 03:52:19 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
country_id: 6252001
description:
2025-02-06 03:52:42 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:34852: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 03:52:51 ait sshd[957915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-52.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
country_id: 3469034
description:
2025-02-06 03:52:08 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:57249: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
country_id: 2921044
description:
2025-02-06 03:53:02 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:49822: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
country_id: 1835841
description:
Feb  6 03:53:12 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
country_id: 1835841
description:
2025-02-06 03:53:14 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:58936: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.31.221.218
country_id: 2464461
description:
[2025-02-06 03:53:20 +0100] info [webmaild] 102.31.221.218 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.105.143
country_id: 3658394
description:
[2025-02-06 03:53:57 +0100] info [webmaild] 157.100.105.143 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.233.206
country_id: 1814991
description:
Feb  6 03:54:37 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.233.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.233.206
country_id: 1814991
description:
2025-02-06 03:54:39 dovecot_login authenticator failed for ([27.45.233.206]) [27.45.233.206]:35542: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
country_id: 1835841
description:
Feb  6 03:54:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
country_id: 1835841
description:
2025-02-06 03:54:20 dovecot_login authenticator failed for ([222.119.124.66]) [222.119.124.66]:40917: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.116.129.114
country_id: 3865483
description:
[2025-02-06 03:54:28 +0100] info [webmaild] 181.116.129.114 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.144.155.68
country_id: 6251999
description:
[2025-02-06 03:55:57 +0100] info [cpaneld] 198.144.155.68 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
country_id: 1814991
description:
2025-02-06 03:56:01 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:42122: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
country_id: 1814991
description:
Feb  6 03:55:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.202.43
country_id: 3469034
description:
[2025-02-06 03:55:59 +0100] info [webmaild] 128.201.202.43 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 03:55:28 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  6 03:55:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.85.17.117
country_id: 2750405
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-55.185.85.17.117


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.212.54
country_id: 2921044
description:
Feb  6 03:55:14 ait sshd[958844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.212.54  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.8.115.241
country_id: 3469034
description:
[2025-02-06 03:55:24 +0100] info [webmaild] 201.8.115.241 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 03:55:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-02-06 03:55:45 dovecot_plain authenticator failed for (haring) [64.72.74.162]:49487: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.78.119.104
country_id: 1835841
description:
Feb  6 03:55:18 ait sshd[958847]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.78.119.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.77.97.146
country_id: 1562822
description:
Feb  6 03:55:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.77.97.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.97.146
country_id: 1562822
description:
2025-02-06 03:55:49 dovecot_plain authenticator failed for (adsl.viettel.vn) [115.77.97.146]:50013: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.201.78.253
country_id: 3469034
description:
Feb  6 03:56:51 ait sshd[959308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.201.78.253


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.100.159
country_id: 6252001
description:
Feb  6 03:56:17 ait sshd[959106]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.100.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.5.26
country_id: 1814991
description:
2025-02-06 03:56:20 dovecot_plain authenticator failed for ([183.237.5.26]) [183.237.5.26]:52440: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
country_id: 1269750
description:
Feb  6 03:56:29 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.128.90.252
country_id: 1880251
description:
Feb  6 03:56:51 ait sshd[959309]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.128.90.252  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.40.137.69
country_id: 3469034
description:
[2025-02-06 03:56:54 +0100] info [webmaild] 201.40.137.69 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
country_id: 1819730
description:
2025-02-06 03:56:09 dovecot_plain authenticator failed for ([39.109.127.195]) [39.109.127.195]:32910: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.236.213.190
country_id: 3469034
description:
2025-02-06 03:56:19 dovecot_plain authenticator failed for 179-236-213-190.user.veloxzone.com.br (179-236-213-137.user.veloxzone.com.br) [179.236.213.190]:34380: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
country_id: 1269750
description:
2025-02-06 03:56:31 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:29282: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
country_id: 1814991
description:
2025-02-06 03:56:44 dovecot_login authenticator failed for ([120.224.15.67]) [120.224.15.67]:32646: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.201.78.253
country_id: 3469034
description:
Feb  6 03:56:51 ait sshd[959308]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.201.78.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
country_id: 1819730
description:
Feb  6 03:56:07 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.236.213.190
country_id: 3469034
description:
Feb  6 03:56:17 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.236.213.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.5.26
country_id: 1814991
description:
Feb  6 03:56:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.5.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.177.201
country_id: 1835841
description:
2025-02-06 03:56:34 dovecot_login authenticator failed for ([14.49.177.201]) [14.49.177.201]:40506: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.177.201
country_id: 1835841
description:
Feb  6 03:56:32 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.177.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
country_id: 1814991
description:
Feb  6 03:56:42 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.129
country_id: 294640
description:
2025-02-06 03:57:53 dovecot_plain authenticator failed for ([2.55.88.129]) [2.55.88.129]:43640: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.92.213
country_id: 1512440
description:
[2025-02-06 03:57:23 +0100] info [webmaild] 213.230.92.213 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
country_id: 1269750
description:
Feb  6 03:57:27 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
country_id: 1269750
description:
2025-02-06 03:57:29 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:53479: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  6 03:57:45 ait sshd[959555]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.5.245.129 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.5.245.129
country_id: 1814991
description:
Feb  6 03:57:45 ait sshd[959555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.5.245.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.129
country_id: 294640
description:
Feb  6 03:57:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.38.94
country_id: 6252001
description:
[2025-02-06 03:58:13 +0100] info [cpaneld] 104.207.38.94 - ads20b00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.84.212
country_id: 6252001
description:
[2025-02-06 03:58:31 +0100] info [whostmgrd] 156.228.84.212 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.87.203
country_id: 6252001
description:
[2025-02-06 03:58:33 +0100] info [whostmgrd] 156.228.87.203 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.218.143
country_id: 3469034
description:
[2025-02-06 03:58:27 +0100] info [webmaild] 177.221.218.143 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 03:58:04 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.111.98
country_id: 6252001
description:
[2025-02-06 03:58:14 +0100] info [cpaneld] 156.228.111.98 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.178
country_id: 6252001
description:
[2025-02-06 03:58:17 +0100] info [cpaneld] 156.228.89.178 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.209
country_id: 6252001
description:
[2025-02-06 03:58:22 +0100] info [cpaneld] 156.228.112.209 - ads20b00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.114.5
country_id: 6252001
description:
[2025-02-06 03:58:28 +0100] info [whostmgrd] 156.228.114.5 - ads20b00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.51.102
country_id: 6252001
description:
[2025-02-06 03:58:35 +0100] info [whostmgrd] 104.207.51.102 - ads20b00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 03:58:57 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.98
country_id: 6252001
description:
[2025-02-06 03:58:19 +0100] info [cpaneld] 104.207.53.98 - ads20b00297Y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20b00297Y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.116.186
country_id: 6252001
description:
[2025-02-06 03:58:24 +0100] info [whostmgrd] 156.228.116.186 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
country_id: 1814991
description:
Feb  6 03:59:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.223.47.8
country_id: 1880251
description:
Feb  6 03:59:46 ait sshd[960319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.223.47.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 03:59:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.248.237.221
country_id: 1819730
description:
Feb  6 03:59:27 ait sshd[960121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 173.248.237.221 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 173.248.237.221
country_id: 1819730
description:
Feb  6 03:59:27 ait sshd[960121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.248.237.221


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.194.38.121
country_id: 3175395
description:
2025-02-06 04:00:00 dovecot_plain authenticator failed for ([2.194.38.121]) [2.194.38.121]:58138: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.177.13.60
country_id: 3469034
description:
[2025-02-06 03:59:02 +0100] info [webmaild] 45.177.13.60 - helpdesk@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.123.32
country_id: 1880251
description:
Feb  6 03:59:40 ait sshd[960163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.123.32  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.205.144
country_id: 3469034
description:
[2025-02-06 04:00:00 +0100] info [webmaild] 45.167.205.144 - helpdesk@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.122.155.190
country_id: 3437598
description:
[2025-02-06 03:59:31 +0100] info [webmaild] 181.122.155.190 - helpdesk@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.123.32
country_id: 1880251
description:
Feb  6 03:59:40 ait sshd[960163]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.123.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
country_id: 1814991
description:
2025-02-06 03:59:49 dovecot_plain authenticator failed for ([115.85.251.188]) [115.85.251.188]:41512: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.117.200
country_id: 1814991
description:
Feb  6 04:00:16 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.117.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
country_id: 2017370
description:
2025-02-06 04:01:02 dovecot_plain authenticator failed for ([95.165.72.156]) [95.165.72.156]:33070: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.57.91
country_id: 1880251
description:
47.128.57.91 - - [06/Feb/2025:04:00:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27840268 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?duration=short%2Cmedium&filtering=1&level=beginner%2Cexpert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.57.91


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
country_id: 2017370
description:
Feb  6 04:00:46 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.125.200
country_id: 294640
description:
Feb  6 04:00:55 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.72.156
country_id: 2017370
description:
Feb  6 04:01:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.72.156 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  6 04:00:07 ait sshd[960549]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.125.200
country_id: 294640
description:
2025-02-06 04:00:57 dovecot_plain authenticator failed for (2-55-125-200.orange.net.il) [2.55.125.200]:56278: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
country_id: 1814991
description:
2025-02-06 04:00:18 dovecot_plain authenticator failed for ([112.15.117.200]) [112.15.117.200]:29295: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
country_id: 2017370
description:
2025-02-06 04:00:48 dovecot_plain authenticator failed for (afised) [89.109.233.181]:47782: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-02-06 04:00:07 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:42476: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.212.39.199
country_id: 1861060
description:
Feb  6 04:00:31 ait sshd[960581]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.212.39.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 04:01:09 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
country_id: 1835841
description:
2025-02-06 04:01:11 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:45864: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
country_id: 2510769
description:
2025-02-06 04:01:46 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:59355: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.159.218
country_id: 1814991
description:
2025-02-06 04:01:49 dovecot_plain authenticator failed for ([221.224.159.220]) [221.224.159.218]:50632: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
country_id: 1814991
description:
Feb  6 04:01:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
country_id: 1668284
description:
2025-02-06 04:02:01 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:34823: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.235.118
country_id: 3865483
description:
[2025-02-06 04:01:07 +0100] info [webmaild] 131.161.235.118 - helpdesk@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
country_id: 2017370
description:
Feb  6 04:01:41 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.55
country_id: 2017370
description:
Feb  6 04:01:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.223.154.170
country_id: 2403846
description:
Feb  6 04:01:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.223.154.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
country_id: 6252001
description:
2025-02-06 04:01:49 dovecot_plain authenticator failed for ([158.140.38.21]) [158.140.38.21]:58606: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.236.213.190
country_id: 3469034
description:
Feb  6 04:01:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.236.213.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.213.240.6
country_id: 1814991
description:
2025-02-06 04:01:58 dovecot_plain authenticator failed for (6.240.213.139.adsl-pool.jlccptt.net.cn) [139.213.240.6]:25768: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.52.116
country_id: 1814991
description:
Feb  6 04:01:30 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.52.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.115
country_id: 1819730
description:
Feb  6 04:01:58 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.101.143
country_id: 2921044
description:
Feb  6 04:02:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.101.143 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 173.248.237.221
country_id: 1819730
description:
Feb  6 04:01:11 ait sshd[961046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.248.237.221


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-06 04:01:16 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:40710: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
country_id: 1814991
description:
Feb  6 04:01:34 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
country_id: 1814991
description:
2025-02-06 04:01:36 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:37684: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.33.44.158
country_id: 798549
description:
2025-02-06 04:01:42 dovecot_plain authenticator failed for ([89.33.44.158]) [89.33.44.158]:56674: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
country_id: 690791
description:
Feb  6 04:01:44 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
country_id: 6251999
description:
2025-02-06 04:01:09 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:53940: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
country_id: 1814991
description:
2025-02-06 04:01:47 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:33751: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  6 04:01:50 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
country_id: 6252001
description:
Feb  6 04:01:51 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-02-06 04:01:53 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:36670: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
country_id: 1668284
description:
Feb  6 04:01:59 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-06 04:01:52 dovecot_plain authenticator failed for ([211.109.75.66]) [211.109.75.69]:50150: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.32.171
country_id: 1880251
description:
47.128.32.171 - - [06/Feb/2025:04:01:52 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=29632294" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.32.171


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
country_id: 1814991
description:
2025-02-06 04:01:12 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:53948: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-02-06 04:01:46 dovecot_plain authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:38597: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.159.218
country_id: 1814991
description:
Feb  6 04:01:47 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.159.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
country_id: 1819730
description:
Feb  6 04:01:52 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.225.207.166
country_id: 1814991
description:
Feb  6 04:02:01 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.225.207.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.6.38
country_id: 1668284
description:
Feb  6 04:01:18 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
country_id: 690791
description:
Feb  6 04:01:43 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
country_id: 1880251
description:
Feb  6 04:01:45 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.55
country_id: 2017370
description:
2025-02-06 04:01:47 dovecot_plain authenticator failed for ([178.178.222.55]) [178.178.222.55]:33352: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
country_id: 1814991
description:
2025-02-06 04:01:52 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:59840: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.232
country_id: 1269750
description:
Feb  6 04:01:53 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
country_id: 3996063
description:
Feb  6 04:02:00 ait auth[883947]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


