# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-02-06 14:32:17 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:58826: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
country_id: 1835841
description:
Feb  6 14:31:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
country_id: 1880251
description:
Feb  6 14:33:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
country_id: 1835841
description:
2025-02-06 14:33:15 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:57421: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
country_id: 1814991
description:
2025-02-06 14:32:44 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:46952: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
country_id: 1694008
description:
2025-02-06 14:33:03 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:24385: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.144.206
country_id: 1814991
description:
2025-02-06 14:33:06 dovecot_plain authenticator failed for ([121.11.144.206]) [121.11.144.206]:42885: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
country_id: 6252001
description:
2025-02-06 14:32:42 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:50534: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
country_id: 1814991
description:
2025-02-06 14:33:00 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:35023: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
country_id: 1835841
description:
2025-02-06 14:33:03 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:58952: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
country_id: 798544
description:
Feb  6 14:32:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
country_id: 1269750
description:
2025-02-06 14:32:56 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:39820: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.144.206
country_id: 1814991
description:
Feb  6 14:33:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.144.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
country_id: 6251999
description:
Feb  6 14:32:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.145.113.30
country_id: 1210997
description:
[2025-02-06 14:32:55 +0100] info [webmaild] 103.145.113.30 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2025-02-06 14:33:15 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:45510: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.216.85.119
country_id: 1835841
description:
Feb  6 14:32:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.216.85.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.196.33
country_id: 1814991
description:
2025-02-06 14:32:45 dovecot_plain authenticator failed for ([39.152.196.33]) [39.152.196.33]:51456: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.85.119
country_id: 1835841
description:
2025-02-06 14:32:45 dovecot_plain authenticator failed for ([211.216.85.119]) [211.216.85.119]:41716: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
country_id: 1814991
description:
2025-02-06 14:32:47 dovecot_plain authenticator failed for ([110.189.153.136]) [110.189.153.136]:55018: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
country_id: 1835841
description:
2025-02-06 14:32:58 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:32870: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-02-06 14:32:42 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:48534: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
country_id: 1835841
description:
Feb  6 14:32:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.216
country_id: 3865483
description:
2025-02-06 14:32:44 dovecot_plain authenticator failed for (201-234-106-216.static.impsat.net.ar) [201.234.106.216]:47219: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
country_id: 1835841
description:
Feb  6 14:33:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.217.199.167
country_id: 1814991
description:
2025-02-06 14:33:02 dovecot_plain authenticator failed for ([114.217.199.167]) [114.217.199.167]:19505: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
country_id: 732800
description:
Feb  6 14:33:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
country_id: 732800
description:
2025-02-06 14:33:08 dovecot_plain authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:53125: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
country_id: 1814991
description:
Feb  6 14:33:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.224.174
country_id: 3469034
description:
[2025-02-06 14:32:32 +0100] info [webmaild] 186.224.224.174 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.247
country_id: 1835841
description:
Feb  6 14:32:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
country_id: 1668284
description:
Feb  6 14:32:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-02-06 14:33:21 dovecot_plain authenticator failed for ([218.22.187.67]) [218.22.187.66]:39232: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.217.199.167
country_id: 1814991
description:
Feb  6 14:33:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.217.199.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
country_id: 1522867
description:
2025-02-06 14:33:02 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:47432: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.177.249.193
country_id: 1819730
description:
Feb  6 14:33:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.177.249.193 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-33.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
country_id: 6252001
description:
Feb  6 14:32:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.174
country_id: 1814991
description:
Feb  6 14:32:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
country_id: 1835841
description:
Feb  6 14:32:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
country_id: 1814991
description:
Feb  6 14:32:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
country_id: 6251999
description:
2025-02-06 14:32:53 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:36809: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
country_id: 1835841
description:
2025-02-06 14:32:45 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:40605: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.212.232
country_id: 337996
description:
Feb  6 14:32:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.212.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.247
country_id: 1835841
description:
2025-02-06 14:32:54 dovecot_plain authenticator failed for ([221.149.233.247]) [221.149.233.247]:46142: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
country_id: 1694008
description:
Feb  6 14:33:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-06 14:33:00 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:52824: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.216
country_id: 3865483
description:
Feb  6 14:32:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.196.33
country_id: 1814991
description:
Feb  6 14:32:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.196.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
country_id: 1814991
description:
Feb  6 14:32:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
country_id: 6252001
description:
Feb  6 14:33:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
country_id: 1814991
description:
Feb  6 14:33:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.54.115.46
country_id: 1512440
description:
Feb  6 14:33:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.54.115.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-06 14:33:11 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:2435: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
country_id: 1835841
description:
Feb  6 14:33:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
country_id: 1880251
description:
2025-02-06 14:33:14 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:34294: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
country_id: 798544
description:
2025-02-06 14:32:40 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:54680: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.137.26
country_id: 1814991
description:
2025-02-06 14:32:44 dovecot_plain authenticator failed for ([61.185.137.26]) [61.185.137.26]:44387: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
country_id: 1269750
description:
Feb  6 14:32:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
country_id: 2921044
description:
2025-02-06 14:32:41 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:43166: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
country_id: 290557
description:
Feb  6 14:32:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.115.164
country_id: 1814991
description:
Feb  6 14:33:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.115.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  6 14:32:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
country_id: 6251999
description:
2025-02-06 14:32:53 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:47804: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.21
country_id: 1269750
description:
Feb  6 14:32:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.42.163.252
country_id: 660013
description:
2025-02-06 14:32:25 dovecot_plain authenticator failed for ([185.42.163.252]) [185.42.163.252]:60088: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
country_id: 2921044
description:
Feb  6 14:32:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.137.26
country_id: 1814991
description:
Feb  6 14:32:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
country_id: 1668284
description:
2025-02-06 14:33:00 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:59497: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
country_id: 6252001
description:
2025-02-06 14:33:10 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:59026: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
country_id: 290557
description:
2025-02-06 14:32:48 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:43753: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
country_id: 337996
description:
2025-02-06 14:32:49 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:54300: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
country_id: 1814991
description:
Feb  6 14:32:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.174
country_id: 1814991
description:
2025-02-06 14:32:48 dovecot_plain authenticator failed for ([27.40.100.174]) [27.40.100.174]:36480: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
country_id: 1835841
description:
Feb  6 14:32:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
country_id: 1522867
description:
Feb  6 14:33:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  6 14:33:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
country_id: 1814991
description:
Feb  6 14:32:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-06 14:32:44 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:43672: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 14:32:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.54.115.46
country_id: 1512440
description:
2025-02-06 14:33:15 dovecot_plain authenticator failed for ([84.54.115.46]) [84.54.115.46]:60826: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
country_id: 6252001
description:
Feb  6 14:32:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.102
country_id: 1819730
description:
Feb  6 14:32:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.102
country_id: 1819730
description:
2025-02-06 14:32:44 dovecot_plain authenticator failed for ([121.202.152.102]) [121.202.152.102]:42551: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.249.193
country_id: 1819730
description:
2025-02-06 14:33:07 dovecot_plain authenticator failed for ([210.177.249.193]) [210.177.249.193]:63923: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.115.164
country_id: 1814991
description:
2025-02-06 14:33:11 dovecot_plain authenticator failed for ([218.94.115.164]) [218.94.115.164]:59756: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
country_id: 1814991
description:
2025-02-06 14:32:48 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:38278: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
country_id: 6251999
description:
Feb  6 14:32:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.21
country_id: 1269750
description:
2025-02-06 14:32:59 dovecot_plain authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:53087: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.8.218.54
country_id: 1814991
description:
Feb  6 14:34:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.8.218.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
country_id: 2963597
description:
Feb  6 14:34:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
country_id: 1269750
description:
2025-02-06 14:34:16 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:51146: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.169.52
country_id: 1814991
description:
Feb  6 14:34:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.169.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-02-06 14:34:05 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:57725: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
country_id: 2963597
description:
2025-02-06 14:34:16 dovecot_login authenticator failed for ([80.233.77.125]) [80.233.77.125]:34993: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.173.18.71
country_id: 1814991
description:
2025-02-06 14:34:19 dovecot_login authenticator failed for ([117.173.18.71]) [117.173.18.71]:34386: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
country_id: 3469034
description:
2025-02-06 14:33:35 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:35469: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.176.41.40
country_id: 2017370
description:
Feb  6 14:33:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.176.41.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 14:33:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.248.178.230
country_id: 1668284
description:
Feb  6 14:33:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.248.178.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.8.218.54
country_id: 1814991
description:
2025-02-06 14:34:14 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:49189: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
country_id: 3469034
description:
Feb  6 14:33:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
country_id: 1814991
description:
2025-02-06 14:34:00 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:54213: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 14:34:03 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:33494: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.250.249.12
country_id: 1269750
description:
Feb  6 14:34:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.250.249.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.173.18.71
country_id: 1814991
description:
Feb  6 14:34:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.173.18.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
country_id: 3469034
description:
Feb  6 14:33:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.248.178.230
country_id: 1668284
description:
2025-02-06 14:33:45 dovecot_plain authenticator failed for 60-248-178-230.hinet-ip.hinet.net [60.248.178.230]:47392: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.176.41.40
country_id: 2017370
description:
2025-02-06 14:33:47 dovecot_plain authenticator failed for ([178.176.41.40]) [178.176.41.40]:47912: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
country_id: 1814991
description:
Feb  6 14:33:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Feb  6 14:34:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.80.2
country_id: 1814991
description:
Feb  6 14:34:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.80.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.80.2
country_id: 1814991
description:
2025-02-06 14:34:19 dovecot_plain authenticator failed for ([1.28.80.2]) [1.28.80.2]:42786: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.237.143
country_id: 1814991
description:
Feb  6 14:33:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.237.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.237.143
country_id: 1814991
description:
2025-02-06 14:33:30 dovecot_plain authenticator failed for ([60.171.237.143]) [60.171.237.143]:42158: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.145.83.236
country_id: 130758
description:
[2025-02-06 14:33:46 +0100] info [webmaild] 2.145.83.236 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
country_id: 3585968
description:
Feb  6 14:34:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.53.58.10
country_id: 1835841
description:
2025-02-06 14:33:43 dovecot_plain authenticator failed for ([211.53.58.10]) [211.53.58.10]:54942: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-02-06 14:33:56 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:58626: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
country_id: 1814991
description:
Feb  6 14:33:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
country_id: 1814991
description:
2025-02-06 14:33:29 dovecot_plain authenticator failed for ([112.111.61.232]) [112.111.61.229]:53188: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.53.58.10
country_id: 1835841
description:
Feb  6 14:33:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.53.58.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.203.251.209
country_id: 1814991
description:
Feb  6 14:34:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.203.251.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
country_id: 2017370
description:
Feb  6 14:34:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.179
country_id: 1269750
description:
Feb  6 14:35:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
country_id: 3017382
description:
2025-02-06 14:35:19 dovecot_login authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:56041: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-02-06 14:35:21 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:39628: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
country_id: 3017382
description:
Feb  6 14:34:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.233.58.140
country_id: 3469034
description:
Feb  6 14:34:55 ait sshd[1231537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.233.58.140 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.233.58.140
country_id: 3469034
description:
Feb  6 14:34:55 ait sshd[1231537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.233.58.140


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
country_id: 290557
description:
Feb  6 14:34:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.28.76
country_id: 1814991
description:
2025-02-06 14:35:17 dovecot_login authenticator failed for ([120.238.28.76]) [120.238.28.76]:54448: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
country_id: 2077456
description:
Feb  6 14:35:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
country_id: 2077456
description:
2025-02-06 14:35:20 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:55370: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.13.243.101
country_id: 2264397
description:
Feb  6 14:34:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.13.243.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.104.103.146
country_id: 1814991
description:
2025-02-06 14:34:42 dovecot_plain authenticator failed for ([180.104.103.146]) [180.104.103.146]:37284: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.203.251.209
country_id: 1814991
description:
2025-02-06 14:34:49 dovecot_login authenticator failed for ([111.203.251.210]) [111.203.251.209]:37180: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.28.76
country_id: 1814991
description:
Feb  6 14:35:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.28.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.166.73
country_id: 1814991
description:
Feb  6 14:34:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.166.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.138
country_id: 1814991
description:
2025-02-06 14:34:30 dovecot_login authenticator failed for ([112.91.124.138]) [112.91.124.138]:38580: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.89.118
country_id: 226074
description:
2025-02-06 14:34:40 dovecot_login authenticator failed for ([196.0.89.118]) [196.0.89.118]:54553: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
country_id: 1668284
description:
2025-02-06 14:34:46 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:51588: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
country_id: 6252001
description:
2025-02-06 14:34:48 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:4487: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.166.73
country_id: 1814991
description:
2025-02-06 14:34:27 dovecot_login authenticator failed for ([117.158.166.73]) [117.158.166.73]:5614: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
country_id: 2413451
description:
2025-02-06 14:34:33 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:40618: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.13.243.101
country_id: 2264397
description:
2025-02-06 14:34:33 dovecot_plain authenticator failed for bl3-243-101.dsl.telepac.pt [213.13.243.101]:4645: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.118
country_id: 226074
description:
Feb  6 14:34:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
country_id: 1814991
description:
Feb  6 14:34:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
country_id: 1814991
description:
Feb  6 14:34:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
country_id: 1814991
description:
2025-02-06 14:34:49 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:60618: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.235
country_id: 99237
description:
2025-02-06 14:35:23 dovecot_plain authenticator failed for (sibuxer) [65.20.168.235]:49549: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.169.52
country_id: 1814991
description:
2025-02-06 14:34:25 dovecot_plain authenticator failed for ([124.239.169.52]) [124.239.169.52]:55995: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 14:34:36 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:33564: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-02-06 14:34:41 dovecot_plain authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:56580: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
country_id: 290557
description:
2025-02-06 14:35:01 dovecot_login authenticator failed for ([5.31.30.115]) [5.31.30.115]:53052: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.179
country_id: 1269750
description:
2025-02-06 14:35:07 dovecot_plain authenticator failed for (static.ill.117.250.107.179.bsnl.co.in) [117.250.107.179]:60469: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
country_id: 3017382
description:
Feb  6 14:35:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.235
country_id: 99237
description:
Feb  6 14:35:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 14:34:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
country_id: 6252001
description:
Feb  6 14:34:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
country_id: 2017370
description:
2025-02-06 14:35:01 dovecot_login authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:55512: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.138
country_id: 1814991
description:
Feb  6 14:34:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
country_id: 1668284
description:
Feb  6 14:34:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
country_id: 1819730
description:
Feb  6 14:35:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
country_id: 1819730
description:
2025-02-06 14:35:03 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:46909: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
country_id: 1880251
description:
Feb  6 14:35:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
country_id: 3469034
description:
Feb  6 14:35:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
country_id: 1814991
description:
2025-02-06 14:35:35 dovecot_login authenticator failed for ([218.22.0.200]) [218.22.0.200]:59230: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
country_id: 1269750
description:
Feb  6 14:35:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-06 14:36:15 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:48423: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
country_id: 1814991
description:
Feb  6 14:35:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
country_id: 2017370
description:
2025-02-06 14:35:52 dovecot_plain authenticator failed for ([178.178.194.203]) [178.178.194.203]:38318: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
country_id: 1269750
description:
2025-02-06 14:35:52 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:55428: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  6 14:36:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
country_id: 690791
description:
Feb  6 14:35:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
country_id: 690791
description:
2025-02-06 14:35:26 dovecot_plain authenticator failed for (unfoory) [37.139.110.118]:34152: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
country_id: 3469034
description:
2025-02-06 14:35:33 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:58525: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
country_id: 2017370
description:
Feb  6 14:35:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.115.7.10
country_id: 614540
description:
[2025-02-06 14:35:59 +0100] info [webmaild] 185.115.7.10 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.92.89.75
country_id: 1269750
description:
Feb  6 14:36:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.92.89.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.25.22.129
country_id: 3932488
description:
[2025-02-06 14:36:56 +0100] info [webmaild] 38.25.22.129 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 102.22.15.203
country_id: 2300660
domain: asfap.ait.edu.gh
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users/me?_locale=user||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
country_id: 3469034
description:
Feb  6 14:36:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.222.249
country_id: 99237
description:
[2025-02-06 14:36:59 +0100] info [webmaild] 37.237.222.249 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
country_id: 1835841
description:
Feb  6 14:37:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
country_id: 1835841
description:
2025-02-06 14:37:02 dovecot_login authenticator failed for ([1.252.204.203]) [1.252.204.203]:49540: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.92.89.75
country_id: 1269750
description:
2025-02-06 14:36:34 dovecot_login authenticator failed for (static-14.38.103.extranet.co.in) [111.92.89.75]:51775: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.233.58.140
country_id: 3469034
description:
Feb  6 14:37:04 ait sshd[1232590]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.233.58.140 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.233.58.140
country_id: 3469034
description:
Feb  6 14:37:04 ait sshd[1232590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.233.58.140


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.150.182
country_id: 1168579
description:
Feb  6 14:37:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.150.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
country_id: 1814991
description:
2025-02-06 14:37:20 dovecot_login authenticator failed for ([112.194.143.206]) [112.194.143.206]:49108: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-06 14:36:49 dovecot_login authenticator failed for 186-247-192-94.user.veloxzone.com.br [186.247.192.94]:34345: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 14:36:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.150.182
country_id: 1168579
description:
2025-02-06 14:37:13 dovecot_login authenticator failed for ([182.176.150.182]) [182.176.150.182]:49597: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
country_id: 1814991
description:
Feb  6 14:37:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.1.214.102
country_id: 1835841
description:
Feb  6 14:37:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.1.214.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.1.214.102
country_id: 1835841
description:
2025-02-06 14:37:34 dovecot_login authenticator failed for ([59.1.214.102]) [59.1.214.102]:58288: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.226.44
country_id: 3865483
description:
[2025-02-06 14:37:53 +0100] info [webmaild] 45.226.226.44 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
country_id: 2510769
description:
Feb  6 14:38:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
country_id: 2510769
description:
2025-02-06 14:38:19 dovecot_login authenticator failed for ([83.136.176.12]) [83.136.176.12]:42469: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
country_id: 3469034
description:
Feb  6 14:38:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-06 14:38:32 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:42924: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
country_id: 1835841
description:
Feb  6 14:38:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 14:38:51 ait sshd[1233194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.57.70.22
country_id: 6252001
description:
Feb  6 14:38:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.57.70.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
country_id: 2077456
description:
Feb  6 14:38:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
country_id: 2077456
description:
2025-02-06 14:38:57 dovecot_login authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:46136: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 14:39:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.233.58.140
country_id: 3469034
description:
Feb  6 14:38:32 ait sshd[1233101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.233.58.140


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 14:38:51 ait sshd[1233194]: Invalid user universitypublishing from 211.108.234.111 port 34246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.79.38
country_id: 1835841
description:
2025-02-06 14:39:17 dovecot_login authenticator failed for ([211.178.79.38]) [211.178.79.38]:49552: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
country_id: 1835841
description:
2025-02-06 14:38:36 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:60080: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.57.70.22
country_id: 6252001
description:
2025-02-06 14:38:58 dovecot_login authenticator failed for (host-216-57-70-22-cal.net) [216.57.70.22]:45017: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 14:39:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.79.38
country_id: 1835841
description:
Feb  6 14:39:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.79.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.233.58.140
country_id: 3469034
description:
Feb  6 14:38:32 ait sshd[1233101]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.233.58.140 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 45.233.58.140
country_id: 3469034
description:
Feb  6 14:38:34 ait sshd[1233101]: Failed password for invalid user deploy from 45.233.58.140 port 47776 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 14:38:51 ait sshd[1233194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-39.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.34
country_id: 99237
description:
Feb  6 14:39:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.39
country_id: 1814991
description:
Feb  6 14:40:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
country_id: 1880251
description:
Feb  6 14:40:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
country_id: 3469034
description:
Feb  6 14:40:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-02-06 14:39:46 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:34730: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.212.136.240
country_id: 6252001
description:
2025-02-06 14:39:50 dovecot_plain authenticator failed for 240.sub-97-212-136.myvzw.com [97.212.136.240]:58690: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.209.50.57
country_id: 1269750
description:
2025-02-06 14:39:51 dovecot_plain authenticator failed for ([117.209.50.57]) [117.209.50.57]:41548: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
country_id: 1814991
description:
2025-02-06 14:40:00 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:28332: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.226.220
country_id: 2017370
description:
2025-02-06 14:39:59 dovecot_plain authenticator failed for ([95.82.226.220]) [95.82.226.220]:49847: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2025-02-06 14:40:04 dovecot_login authenticator failed for ([192.34.128.202]) [192.34.128.202]:54300: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
country_id: 6252001
description:
2025-02-06 14:40:17 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:47822: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
country_id: 99237
description:
Feb  6 14:39:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.212.136.240
country_id: 6252001
description:
Feb  6 14:39:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.212.136.240 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.118.32
country_id: 3469034
description:
[2025-02-06 14:40:01 +0100] info [webmaild] 45.190.118.32 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Feb  6 14:40:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-02-06 14:40:14 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:41374: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
country_id: 1814991
description:
2025-02-06 14:40:24 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:54947: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
country_id: 690791
description:
2025-02-06 14:39:48 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:39684: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
country_id: 1880251
description:
Feb  6 14:39:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
country_id: 1835841
description:
2025-02-06 14:40:16 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:52592: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
country_id: 1814991
description:
Feb  6 14:40:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.82.226.220
country_id: 2017370
description:
Feb  6 14:39:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.82.226.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
country_id: 3658394
description:
Feb  6 14:40:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
country_id: 6252001
description:
Feb  6 14:40:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
country_id: 690791
description:
Feb  6 14:39:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.209.50.57
country_id: 1269750
description:
Feb  6 14:39:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.209.50.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
country_id: 1814991
description:
Feb  6 14:39:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
country_id: 1835841
description:
2025-02-06 14:39:53 dovecot_plain authenticator failed for ([183.105.3.221]) [183.105.3.221]:60866: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
country_id: 1814991
description:
2025-02-06 14:39:54 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:51697: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.39
country_id: 1814991
description:
2025-02-06 14:40:09 dovecot_plain authenticator failed for ([61.185.68.39]) [61.185.68.39]:44069: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
country_id: 1835841
description:
Feb  6 14:40:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.34
country_id: 99237
description:
2025-02-06 14:39:46 dovecot_login authenticator failed for ([65.20.204.34]) [65.20.204.34]:51674: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
country_id: 1835841
description:
Feb  6 14:39:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
country_id: 1880251
description:
2025-02-06 14:39:57 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:47446: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-02-06 14:40:04 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:56497: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
country_id: 3996063
description:
2025-02-06 14:40:06 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:34596: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
country_id: 1835841
description:
Feb  6 14:39:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
country_id: 1835841
description:
2025-02-06 14:39:51 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:43424: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
country_id: 1880251
description:
2025-02-06 14:40:02 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:46069: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
country_id: 1835841
description:
Feb  6 14:40:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2025-02-06 14:40:24 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:35438: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
country_id: 6252001
description:
Feb  6 14:40:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.241
country_id: 2635167
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:14-41.77.83.1.241


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-02-06 14:40:27 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:37889: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.4
country_id: 1835841
description:
Feb  6 14:40:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 14:40:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
country_id: 1835841
description:
2025-02-06 14:40:40 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:44936: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.8.21
country_id: 2661886
description:
2025-02-06 14:40:55 dovecot_login authenticator failed for (ADMIN) [46.246.8.21]:63010: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.109.198.115
country_id: 3469034
description:
[2025-02-06 14:40:58 +0100] info [webmaild] 179.109.198.115 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.118
country_id: 1814991
description:
Feb  6 14:40:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.118 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.201
country_id: 2635167
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:14-41.77.83.1.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.56.151.137
country_id: 690791
description:
[2025-02-06 14:41:18 +0100] info [webmaild] 193.56.151.137 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
country_id: 1835841
description:
Feb  6 14:40:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
country_id: 6252001
description:
2025-02-06 14:40:36 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:56934: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 14:40:37 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-179.static.tpgi.com.au) [110.175.220.250]:39041: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.118
country_id: 1814991
description:
2025-02-06 14:40:27 dovecot_plain authenticator failed for ([61.185.226.118]) [61.185.226.118]:53314: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
country_id: 2264397
description:
Feb  6 14:41:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2025-02-06 14:42:23 dovecot_login authenticator failed for ([59.22.68.213]) [59.22.68.213]:43173: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.83.205
country_id: 1814991
description:
Feb  6 14:42:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.83.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
country_id: 1835841
description:
Feb  6 14:42:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
country_id: 1835841
description:
2025-02-06 14:42:20 dovecot_login authenticator failed for ([210.113.122.243]) [210.113.122.243]:51846: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
country_id: 2264397
description:
2025-02-06 14:41:54 dovecot_login authenticator failed for ([62.28.66.78]) [62.28.66.78]:45012: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.83.205
country_id: 1814991
description:
2025-02-06 14:42:10 dovecot_login authenticator failed for ([58.18.83.205]) [58.18.83.205]:43018: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.51.96.219
country_id: 3865483
description:
[2025-02-06 14:42:12 +0100] info [webmaild] 200.51.96.219 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
country_id: 1694008
description:
2025-02-06 14:42:02 dovecot_login authenticator failed for (119.93.87.71.static.pldt.net) [119.93.87.71]:1422: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
country_id: 1814991
description:
Feb  6 14:42:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
country_id: 1814991
description:
2025-02-06 14:42:08 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:37223: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
country_id: 1814991
description:
Feb  6 14:42:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
country_id: 6252001
description:
Feb  6 14:41:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
country_id: 6252001
description:
2025-02-06 14:41:53 dovecot_login authenticator failed for ([107.150.100.139]) [107.150.100.139]:23822: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
country_id: 1694008
description:
Feb  6 14:42:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 14:42:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
country_id: 1814991
description:
2025-02-06 14:42:10 dovecot_login authenticator failed for ([219.153.13.161]) [219.153.13.161]:40326: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.22.68.213
country_id: 1835841
description:
Feb  6 14:42:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.22.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.117.181
country_id: 1880251
description:
47.128.117.181 - - [06/Feb/2025:14:43:08 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18173432 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/recipes/?filter_course-category=106&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.117.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 14:43:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.19
country_id: 895949
description:
Feb  6 14:42:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.19
country_id: 895949
description:
2025-02-06 14:42:59 dovecot_login authenticator failed for (ppp19-lumwana.zamnet.zm) [196.46.199.19]:40519: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Feb  6 14:43:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-06 14:43:09 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:16849: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
country_id: 1835841
description:
Feb  6 14:43:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
country_id: 1835841
description:
2025-02-06 14:43:23 dovecot_login authenticator failed for ([210.99.223.203]) [210.99.223.203]:38594: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.218.6
country_id: 3469034
description:
[2025-02-06 14:44:08 +0100] info [webmaild] 45.169.218.6 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-43.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-06 14:43:37 dovecot_login authenticator failed for ([103.115.254.158]) [103.115.254.158]:57626: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  6 14:43:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.221
country_id: 1880251
description:
47.128.50.221 - - [06/Feb/2025:14:43:59 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17163462 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?filtering=1&level=intermediate&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.221


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.239.87.6
country_id: 6252001
description:
2025-02-06 14:44:24 dovecot_plain authenticator failed for (undened) [96.239.87.6]:44468: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
country_id: 6252001
description:
Feb  6 14:44:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.47.148.54
country_id: 587116
description:
[2025-02-06 14:45:04 +0100] info [webmaild] 212.47.148.54 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 14:44:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 14:46:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
country_id: 1814991
description:
Feb  6 14:46:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 14:46:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.41.153
country_id: 3469034
description:
[2025-02-06 14:45:38 +0100] info [webmaild] 201.71.41.153 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-45.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.132.7.7
country_id: 3996063
description:
Feb  6 14:47:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.132.7.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.132.7.7
country_id: 3996063
description:
2025-02-06 14:47:05 dovecot_login authenticator failed for (customer-pue-mca-7-7.megared.net.mx) [201.132.7.7]:38249: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.80.125
country_id: 3469034
description:
[2025-02-06 14:46:28 +0100] info [webmaild] 45.172.80.125 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
country_id: 690791
description:
2025-02-06 14:46:34 dovecot_login authenticator failed for ([46.98.10.109]) [46.98.10.109]:50422: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 14:47:11 ait sshd[1237294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.98.10.109
country_id: 690791
description:
Feb  6 14:46:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.98.10.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
country_id: 3996063
description:
2025-02-06 14:46:49 dovecot_login authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:52856: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.226.88
country_id: 3996063
description:
Feb  6 14:46:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.226.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 14:47:11 ait sshd[1237294]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
country_id: 2017370
description:
Feb  6 14:46:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
country_id: 2017370
description:
2025-02-06 14:46:44 dovecot_login authenticator failed for (22.32.117.87.donpac.ru) [87.117.32.22]:56740: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
country_id: 3469034
description:
2025-02-06 14:48:00 dovecot_login authenticator failed for (200-205-22-25.customer.tdatabrasil.net.br) [186.200.158.42]:34895: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.161.52.149
country_id: 1814991
description:
Feb  6 14:48:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.161.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
country_id: 1814991
description:
2025-02-06 14:48:19 dovecot_login authenticator failed for ([58.51.122.230]) [58.51.122.230]:44690: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
country_id: 1814991
description:
2025-02-06 14:48:07 dovecot_login authenticator failed for ([222.163.236.235]) [222.163.236.235]:49498: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2025-02-06 14:48:07 dovecot_login authenticator failed for 111-70-32-50.emome-ip.hinet.net [111.70.32.50]:41443: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
country_id: 1814991
description:
Feb  6 14:47:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
country_id: 3469034
description:
Feb  6 14:47:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.50
country_id: 1668284
description:
Feb  6 14:48:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
country_id: 1814991
description:
2025-02-06 14:47:45 dovecot_login authenticator failed for ([218.94.104.181]) [218.94.104.180]:56106: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
country_id: 290557
description:
Feb  6 14:47:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.12.44
country_id: 2017370
description:
2025-02-06 14:47:57 dovecot_login authenticator failed for ([5.142.12.44]) [5.142.12.44]:37951: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
country_id: 1814991
description:
Feb  6 14:48:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
country_id: 1814991
description:
2025-02-06 14:48:10 dovecot_login authenticator failed for ([220.161.52.149]) [220.161.52.149]:38162: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
country_id: 290557
description:
2025-02-06 14:47:59 dovecot_login authenticator failed for ([5.30.215.71]) [5.30.215.71]:52618: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 14:48:05 ait sshd[1237593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
country_id: 1814991
description:
Feb  6 14:47:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
country_id: 1814991
description:
2025-02-06 14:47:45 dovecot_login authenticator failed for ([183.196.174.235]) [183.196.174.235]:16550: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.12.44
country_id: 2017370
description:
Feb  6 14:47:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.51.93
country_id: 3469034
description:
[2025-02-06 14:47:59 +0100] info [webmaild] 191.5.51.93 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 14:48:05 ait sshd[1237593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
country_id: 1814991
description:
Feb  6 14:48:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77350274
name: IM360 WAF: Theme customization in WordPress
abuser: 102.22.15.203
country_id: 2300660
domain: asfap.ait.edu.gh
description:
IM360 WAF: Theme customization in WordPress||MVN:ARGS:wp_customize||MV:on||WPU:admin_asfap||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.107.104.229
country_id: 1819730
description:
2025-02-06 14:49:18 dovecot_login authenticator failed for (ADMIN) [86.107.104.229]:46044: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.171.26
country_id: 1814991
description:
Feb  6 14:49:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.171.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.231.17.194
country_id: 3865483
description:
2025-02-06 14:48:28 dovecot_login authenticator failed for ([152.231.17.213]) [152.231.17.194]:50470: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.222.49.250
country_id: 3625428
description:
[2025-02-06 14:48:53 +0100] info [webmaild] 38.222.49.250 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.73.22.66
country_id: 3703430
description:
2025-02-06 14:48:58 dovecot_login authenticator failed for ([186.73.22.66]) [186.73.22.66]:58132: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  6 14:49:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-06 14:49:07 dovecot_login authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:19029: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.171.26
country_id: 1814991
description:
2025-02-06 14:49:22 dovecot_plain authenticator failed for ([120.236.171.26]) [120.236.171.26]:50904: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
country_id: 1814991
description:
Feb  6 14:48:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
country_id: 3469034
description:
Feb  6 14:48:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.73.22.66
country_id: 3703430
description:
Feb  6 14:48:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.73.22.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
country_id: 1814991
description:
2025-02-06 14:48:45 dovecot_login authenticator failed for ([116.114.97.10]) [116.114.97.10]:52273: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
country_id: 3469034
description:
2025-02-06 14:48:55 dovecot_login authenticator failed for ([201.88.186.142]) [201.88.186.142]:38586: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.223.193.232
country_id: 597427
description:
2025-02-06 14:49:52 dovecot_plain authenticator failed for (88-223-193-232.init.lt) [88.223.193.232]:46304: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-06 14:49:53 dovecot_login authenticator failed for ([223.80.109.135]) [27.223.100.90]:56784: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.149.125.227
country_id: 2328926
description:
2025-02-06 14:50:02 dovecot_login authenticator failed for ([197.149.125.227]) [197.149.125.227]:53376: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.118.248
country_id: 1814991
description:
2025-02-06 14:50:25 dovecot_plain authenticator failed for ([183.6.118.248]) [183.6.118.248]:37954: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.35.18
country_id: 1814991
description:
Feb  6 14:49:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.35.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.109
country_id: 1668284
description:
2025-02-06 14:50:12 dovecot_login authenticator failed for 111-70-49-109.emome-ip.hinet.net [111.70.49.109]:54082: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
country_id: 6251999
description:
Feb  6 14:49:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
country_id: 1814991
description:
2025-02-06 14:49:32 dovecot_plain authenticator failed for ([183.167.217.86]) [183.167.217.86]:54172: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
country_id: 2017370
description:
Feb  6 14:49:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
country_id: 2017370
description:
2025-02-06 14:49:50 dovecot_login authenticator failed for ([178.178.222.53]) [178.178.222.53]:37338: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  6 14:49:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
country_id: 2661886
description:
2025-02-06 14:50:05 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:51542: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.217.86
country_id: 1814991
description:
Feb  6 14:49:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.217.86 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.47.45.87
country_id: 1168579
description:
[2025-02-06 14:49:39 +0100] info [webmaild] 202.47.45.87 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.223.193.232
country_id: 597427
description:
Feb  6 14:49:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.223.193.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.109
country_id: 1668284
description:
Feb  6 14:50:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.118.248
country_id: 1814991
description:
Feb  6 14:50:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.118.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
country_id: 6251999
description:
2025-02-06 14:49:32 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:38640: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.35.18
country_id: 1814991
description:
2025-02-06 14:49:58 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:39041: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.149.125.227
country_id: 2328926
description:
Feb  6 14:50:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.149.125.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
country_id: 294640
description:
Feb  6 14:50:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
country_id: 1880251
description:
Feb  6 14:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.103
country_id: 1668284
description:
2025-02-06 14:50:39 dovecot_plain authenticator failed for 110-25-104-103.adsl.fetnet.net [110.25.104.103]:51818: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-02-06 14:51:02 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:41273: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.64
country_id: 6251999
description:
Feb  6 14:51:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 14:50:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
country_id: 1880251
description:
2025-02-06 14:50:33 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:43223: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
country_id: 294640
description:
2025-02-06 14:50:57 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:34426: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
country_id: 3469034
description:
Feb  6 14:51:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.122.45
country_id: 3469034
description:
[2025-02-06 14:50:27 +0100] info [webmaild] 128.201.122.45 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.64
country_id: 6251999
description:
2025-02-06 14:51:17 dovecot_plain authenticator failed for s142-59-214-64.ab.hsia.telus.net [142.59.214.64]:39837: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.103
country_id: 1668284
description:
Feb  6 14:50:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
country_id: 1814991
description:
Feb  6 14:52:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
country_id: 1814991
description:
2025-02-06 14:52:08 dovecot_login authenticator failed for ([112.48.104.200]) [112.48.104.200]:42997: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
country_id: 6252001
description:
Feb  6 14:52:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
country_id: 1814991
description:
Feb  6 14:52:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-52.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 14:51:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-02-06 14:52:18 dovecot_plain authenticator failed for ([218.22.187.68]) [218.22.187.66]:36490: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
country_id: 294640
description:
Feb  6 14:52:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
country_id: 294640
description:
2025-02-06 14:52:02 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:28847: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 14:52:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 14:52:19 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:38566: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
country_id: 1831722
description:
Feb  6 14:51:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
country_id: 1831722
description:
2025-02-06 14:52:00 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:56924: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.237.247.137
country_id: 99237
description:
[2025-02-06 14:52:12 +0100] info [webmaild] 37.237.247.137 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
country_id: 6252001
description:
2025-02-06 14:52:14 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:43834: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-06 14:52:50 dovecot_login authenticator failed for ([211.178.165.251]) [211.178.165.251]:49477: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.23.175.243
country_id: 3469034
description:
[2025-02-06 14:52:51 +0100] info [webmaild] 187.23.175.243 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
country_id: 6252001
description:
Feb  6 14:52:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
country_id: 6251999
description:
Feb  6 14:52:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
country_id: 1835841
description:
Feb  6 14:52:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 14:52:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
country_id: 6252001
description:
Feb  6 14:53:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.139.116.184
country_id: 1814991
description:
Feb  6 14:52:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.139.116.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
country_id: 6252001
description:
Feb  6 14:53:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77316831
name: IM360 WAF: Suspicious WordPress plugin installation attempt
abuser: 102.22.15.203
country_id: 2300660
domain: asfap.ait.edu.gh
description:
IM360 WAF: Suspicious WordPress plugin installation attempt||File:elementor-pro.zip||WPU:admin_asfap||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
country_id: 6252001
description:
2025-02-06 14:52:39 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:53845: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
country_id: 6251999
description:
2025-02-06 14:52:40 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:39652: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
country_id: 6252001
description:
2025-02-06 14:53:06 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:32945: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
country_id: 6252001
description:
2025-02-06 14:53:21 dovecot_login authenticator failed for ([50.201.37.210]) [50.201.37.210]:61860: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.139.116.184
country_id: 1814991
description:
2025-02-06 14:52:51 dovecot_plain authenticator failed for ([123.139.116.184]) [123.139.116.184]:45584: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
country_id: 2077456
description:
Feb  6 14:53:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
country_id: 1814991
description:
Feb  6 14:53:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
country_id: 1814991
description:
2025-02-06 14:53:57 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:51046: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
country_id: 2077456
description:
Feb  6 14:54:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 14:53:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.103
country_id: 1668284
description:
Feb  6 14:53:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
country_id: 6252001
description:
Feb  6 14:54:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.153.177.192
country_id: 1835841
description:
2025-02-06 14:54:15 dovecot_plain authenticator failed for ([221.153.177.192]) [221.153.177.192]:46108: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  6 14:54:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
country_id: 2077456
description:
2025-02-06 14:53:34 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:49613: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 14:53:35 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:40334: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.153.51
country_id: 6251999
description:
2025-02-06 14:54:03 dovecot_login authenticator failed for (ADMIN) [181.214.153.51]:43424: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.137.183.4
country_id: 3625428
description:
[2025-02-06 14:53:40 +0100] info [webmaild] 38.137.183.4 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.103
country_id: 1668284
description:
2025-02-06 14:53:42 dovecot_plain authenticator failed for 110-25-104-103.adsl.fetnet.net [110.25.104.103]:60124: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
country_id: 2077456
description:
2025-02-06 14:54:02 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:50983: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
country_id: 6252001
description:
2025-02-06 14:54:07 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:52496: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.153.177.192
country_id: 1835841
description:
Feb  6 14:54:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.153.177.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.146.120.163
country_id: 1814991
description:
Feb  6 14:55:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.146.120.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.146.120.163
country_id: 1814991
description:
2025-02-06 14:55:12 dovecot_login authenticator failed for ([61.146.120.163]) [61.146.120.163]:49866: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-06 14:54:26 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:57452: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 14:54:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
country_id: 1835841
description:
Feb  6 14:54:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
country_id: 3469034
description:
Feb  6 14:54:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.57.33.221
country_id: 1269750
description:
Feb  6 14:54:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.57.33.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.32.253
country_id: 3469034
description:
[2025-02-06 14:54:30 +0100] info [webmaild] 201.182.32.253 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
country_id: 1835841
description:
2025-02-06 14:54:44 dovecot_login authenticator failed for ([121.164.135.251]) [121.164.135.251]:45163: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 14:55:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.102.233
country_id: 1814991
description:
2025-02-06 14:55:11 dovecot_login authenticator failed for ([183.236.102.233]) [183.236.102.233]:41592: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.243.106.218
country_id: 2802361
description:
Feb  6 14:55:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.243.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
country_id: 1643084
description:
Feb  6 14:55:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
country_id: 1643084
description:
2025-02-06 14:55:20 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:33728: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
country_id: 2802361
description:
2025-02-06 14:55:15 dovecot_login authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be [81.243.106.218]:47632: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
country_id: 3469034
description:
2025-02-06 14:54:51 dovecot_login authenticator failed for ([179.252.107.105]) [177.6.235.62]:49958: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.57.33.221
country_id: 1269750
description:
2025-02-06 14:54:57 dovecot_login authenticator failed for ([120.57.33.221]) [120.57.33.221]:34181: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
country_id: 1835841
description:
Feb  6 14:55:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
country_id: 1835841
description:
2025-02-06 14:55:06 dovecot_login authenticator failed for ([106.246.6.133]) [106.246.6.133]:60592: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.102.233
country_id: 1814991
description:
Feb  6 14:55:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.102.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.202
country_id: 1269750
description:
2025-02-06 14:56:19 dovecot_login authenticator failed for ([103.146.233.202]) [103.146.233.202]:45913: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 14:55:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.250.50
country_id: 1814991
description:
Feb  6 14:55:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.250.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 159.223.206.253
country_id: 6252001
domain: titedu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:14-55.159.223.206.253||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
country_id: 6252001
description:
Feb  6 14:56:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 14:55:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 14:55:26 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:17742: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
country_id: 1814991
description:
2025-02-06 14:55:54 dovecot_plain authenticator failed for ([122.225.55.98]) [122.225.55.98]:36481: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
country_id: 1835841
description:
2025-02-06 14:55:36 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:52089: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.250.50
country_id: 1814991
description:
2025-02-06 14:55:58 dovecot_login authenticator failed for (50.250.223.60.adsl-pool.sx.cn) [60.223.250.50]:35866: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.202
country_id: 1269750
description:
Feb  6 14:56:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
country_id: 1814991
description:
Feb  6 14:55:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 159.223.206.253
country_id: 6252001
domain: titedu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/titlemas/public_html/TITEDU.US/wp-admin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
country_id: 1814991
description:
2025-02-06 14:56:15 dovecot_login authenticator failed for ([61.131.46.146]) [61.131.46.146]:41978: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
country_id: 6251999
description:
Feb  6 14:56:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.54.36
country_id: 1814991
description:
Feb  6 14:55:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.54.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.54.36
country_id: 1814991
description:
2025-02-06 14:55:35 dovecot_login authenticator failed for ([60.172.54.36]) [60.172.54.36]:51621: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.88.95.156
country_id: 3625428
description:
[2025-02-06 14:55:55 +0100] info [webmaild] 186.88.95.156 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
country_id: 1814991
description:
Feb  6 14:56:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
country_id: 1835841
description:
Feb  6 14:55:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
country_id: 6251999
description:
2025-02-06 14:56:23 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:48034: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.95.179
country_id: 1814991
description:
Feb  6 14:56:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.95.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
country_id: 2017370
description:
2025-02-06 14:56:32 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:58016: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.174.45
country_id: 2017370
description:
Feb  6 14:56:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.174.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-02-06 14:56:31 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:64100: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.95.179
country_id: 1814991
description:
2025-02-06 14:56:33 dovecot_login authenticator failed for ([183.236.95.179]) [183.236.95.179]:44955: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.106.70.64
country_id: 3469034
description:
[2025-02-06 14:56:47 +0100] info [webmaild] 179.106.70.64 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 14:57:00 ait sshd[1241316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
country_id: 1835841
description:
Feb  6 14:57:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2025-02-06 14:56:24 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:39186: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  6 14:57:00 ait sshd[1241316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
country_id: 732800
description:
Feb  6 14:56:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 14:57:46 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:34166: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
country_id: 1880251
description:
Feb  6 14:57:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
country_id: 1880251
description:
2025-02-06 14:57:58 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:40301: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
country_id: 1835841
description:
Feb  6 14:58:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.219.177.95
country_id: 1814991
description:
Feb  6 14:57:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.219.177.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.1.117.226
country_id: 1562822
description:
Feb  6 14:58:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.1.117.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.155.142.217
country_id: 2542007
description:
[2025-02-06 14:58:20 +0100] info [webmaild] 105.155.142.217 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.71.47.18
country_id: 1210997
description:
[2025-02-06 14:57:31 +0100] info [webmaild] 103.71.47.18 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 14:57:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2025-02-06 14:57:46 dovecot_plain authenticator failed for ([113.219.177.95]) [113.219.177.95]:55560: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
country_id: 1835841
description:
2025-02-06 14:58:20 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:53444: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.117.226
country_id: 1562822
description:
2025-02-06 14:58:21 dovecot_plain authenticator failed for ([103.95.156.1]) [42.1.117.226]:65067: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
country_id: 1835841
description:
2025-02-06 14:57:25 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:51342: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
country_id: 2017370
description:
2025-02-06 14:59:12 dovecot_login authenticator failed for ([178.35.155.182]) [178.35.155.182]:41536: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
country_id: 1835841
description:
2025-02-06 14:59:21 dovecot_login authenticator failed for ([220.85.251.16]) [220.85.251.16]:51052: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.112.159
country_id: 2661886
description:
2025-02-06 14:58:29 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:52090: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
country_id: 6252001
description:
Feb  6 14:58:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.131.174.194
country_id: 1835841
description:
Feb  6 14:58:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.131.174.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.131.174.194
country_id: 1835841
description:
2025-02-06 14:58:52 dovecot_login authenticator failed for ([118.131.174.194]) [118.131.174.194]:52534: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.249.210
country_id: 1835841
description:
Feb  6 14:58:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.249.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.249.210
country_id: 1835841
description:
2025-02-06 14:59:00 dovecot_plain authenticator failed for ([211.193.249.210]) [211.193.249.210]:49495: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.112.159
country_id: 2661886
description:
Feb  6 14:58:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.112.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
country_id: 6252001
description:
2025-02-06 14:58:34 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:33496: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-58.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 14:59:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.107.227.57
country_id: 248816
description:
[2025-02-06 15:00:01 +0100] info [webmaild] 109.107.227.57 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.117.200
country_id: 1814991
description:
2025-02-06 15:00:02 dovecot_login authenticator failed for ([112.15.117.200]) [112.15.117.200]:31838: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.203.43
country_id: 1814991
description:
2025-02-06 15:00:07 dovecot_login authenticator failed for ([220.172.203.43]) [220.172.203.43]:49599: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
country_id: 1269750
description:
Feb  6 15:00:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-59.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
country_id: 1835841
description:
2025-02-06 14:59:54 dovecot_login authenticator failed for ([123.212.0.131]) [123.212.0.131]:54006: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 14:59:59 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:46765: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
country_id: 1269750
description:
2025-02-06 15:00:12 dovecot_login authenticator failed for ([103.109.44.163]) [122.165.137.159]:59486: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
country_id: 1814991
description:
2025-02-06 14:59:32 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:18565: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.253.142
country_id: 1269750
description:
2025-02-06 14:59:54 dovecot_login authenticator failed for (abts-tn-static-142.253.165.122.airtelbroadband.in) [122.165.253.142]:35241: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
country_id: 2510769
description:
2025-02-06 15:00:05 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:34916: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-06 15:00:07 dovecot_login authenticator failed for ([103.177.40.85]) [103.177.40.85]:32877: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-06 15:00:15 dovecot_login authenticator failed for (corporativo.static.gvt.net.br) [186.215.107.189]:46511: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
country_id: 1835841
description:
2025-02-06 15:00:19 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:46440: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.191
country_id: 1880251
description:
47.128.99.191 - - [06/Feb/2025:15:00:19 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20607714 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=99%2C183%2C198&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.191


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
country_id: 3865483
description:
2025-02-06 14:59:52 dovecot_login authenticator failed for ([190.104.199.251]) [190.104.199.251]:59459: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
country_id: 1835841
description:
2025-02-06 15:00:02 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:54567: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.8.218.54
country_id: 1814991
description:
2025-02-06 14:59:51 dovecot_login authenticator failed for ([113.8.218.54]) [113.8.218.54]:58166: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2025-02-06 14:59:53 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:55437: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.235.148
country_id: 1814991
description:
2025-02-06 15:00:16 dovecot_login authenticator failed for ([27.45.235.148]) [27.45.235.148]:42672: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.40.138
country_id: 1814991
description:
2025-02-06 14:59:33 dovecot_login authenticator failed for ([27.115.40.138]) [27.115.40.138]:51103: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
country_id: 1814991
description:
2025-02-06 14:59:35 dovecot_login authenticator failed for ([27.24.141.90]) [27.24.141.90]:32808: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.105.217
country_id: 1814991
description:
2025-02-06 15:00:49 dovecot_login authenticator failed for ([163.179.105.217]) [163.179.105.217]:47657: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.84.216.11
country_id: 3469034
description:
[2025-02-06 15:00:57 +0100] info [webmaild] 206.84.216.11 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.38.211.155
country_id: 1861060
description:
2025-02-06 15:00:55 dovecot_login authenticator failed for p383156-obmd01.tokyo.ocn.ne.jp [60.38.211.155]:41528: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2025-02-06 15:01:03 dovecot_login authenticator failed for ([109.233.21.109]) [109.233.21.109]:54778: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
country_id: 1835841
description:
2025-02-06 15:01:15 dovecot_login authenticator failed for ([121.154.90.47]) [121.154.90.47]:56160: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
country_id: 617790
description:
2025-02-06 15:01:17 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:49626: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-02-06 15:00:25 dovecot_login authenticator failed for ([203.145.142.243]) [203.145.142.243]:60608: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.204.125.125
country_id: 1835841
description:
2025-02-06 15:00:32 dovecot_login authenticator failed for ([210.204.125.125]) [210.204.125.125]:43257: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
country_id: 1819730
description:
2025-02-06 15:00:37 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:31410: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
country_id: 1562822
description:
2025-02-06 15:01:01 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [171.227.200.201]:47577: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.92.89.75
country_id: 1269750
description:
2025-02-06 15:01:11 dovecot_login authenticator failed for (static-14.38.103.extranet.co.in) [111.92.89.75]:53363: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.101
country_id: 1814991
description:
2025-02-06 15:01:13 dovecot_plain authenticator failed for ([14.21.36.101]) [14.21.36.101]:57503: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.22.55
country_id: 3469034
description:
2025-02-06 15:02:19 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:41884: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
country_id: 1819730
description:
2025-02-06 15:02:19 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:22262: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-06 15:02:21 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:42506: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.224.2.159
country_id: 3469034
description:
[2025-02-06 15:01:44 +0100] info [webmaild] 181.224.2.159 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
country_id: 3017382
description:
2025-02-06 15:01:48 dovecot_login authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:43210: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.49
country_id: 1668284
description:
2025-02-06 15:01:53 dovecot_login authenticator failed for 111-70-32-49.emome-ip.hinet.net [111.70.32.49]:53458: 535 Incorrect authentication data (set_id=eng20a00070y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
country_id: 6251999
description:
2025-02-06 15:01:56 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:54800: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.128.91
country_id: 1861060
description:
2025-02-06 15:02:19 dovecot_plain authenticator failed for p81092-obmd01.osaka.ocn.ne.jp [180.7.128.91]:52481: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-06 15:02:23 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:45590: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-06 15:02:14 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:42470: 535 Incorrect authentication data (set_id=eng20a00113y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
country_id: 6251999
description:
2025-02-06 15:02:19 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:56115: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
country_id: 1835841
description:
2025-02-06 15:02:21 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:39329: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
country_id: 1269750
description:
2025-02-06 15:01:29 dovecot_plain authenticator failed for ([59.97.139.38]) [59.97.139.38]:49891: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-06 15:02:02 dovecot_login authenticator failed for ([121.134.31.193]) [121.134.31.193]:55474: 535 Incorrect authentication data (set_id=eng20a00113y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.60.24
country_id: 2017370
description:
2025-02-06 15:02:16 dovecot_plain authenticator failed for (l49-60-24.novotelecom.ru) [178.49.60.24]:56594: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
country_id: 3469034
description:
2025-02-06 15:02:20 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:36096: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
country_id: 1835841
description:
2025-02-06 15:02:23 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:44002: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.83.237
country_id: 6252001
description:
2025-02-06 15:01:46 dovecot_plain authenticator failed for syn-172-118-083-237.res.spectrum.com [172.118.83.237]:60256: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-02-06 15:01:53 dovecot_login authenticator failed for (nsg-corporate-35.174.186.122.airtel.in) [122.186.174.35]:38958: 535 Incorrect authentication data (set_id=cole)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-06 15:02:19 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:53067: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
country_id: 1835841
description:
2025-02-06 15:02:21 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:51246: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.255.239
country_id: 1814991
description:
2025-02-06 15:02:23 dovecot_plain authenticator failed for ([117.69.255.239]) [117.69.255.239]:34300: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
country_id: 1835841
description:
2025-02-06 15:01:40 dovecot_login authenticator failed for ([1.245.207.104]) [1.245.207.104]:55175: 535 Incorrect authentication data (set_id=eng20a00070y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
country_id: 1814991
description:
2025-02-06 15:02:02 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:48634: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-02-06 15:02:18 dovecot_plain authenticator failed for ([203.172.213.166]) [203.172.213.166]:57358: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
country_id: 6252001
description:
2025-02-06 15:02:18 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:48632: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
country_id: 3469034
description:
2025-02-06 15:01:29 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:58358: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.151.45.136
country_id: 1814991
description:
2025-02-06 15:01:33 dovecot_plain authenticator failed for ([182.151.45.136]) [182.151.45.136]:48017: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
country_id: 1814991
description:
2025-02-06 15:01:41 dovecot_plain authenticator failed for ([183.196.174.235]) [183.196.174.235]:8246: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-02-06 15:01:58 dovecot_login authenticator failed for ([196.188.187.85]) [196.188.187.85]:47600: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
country_id: 2623032
description:
Feb  6 15:02:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
country_id: 2623032
description:
2025-02-06 15:02:17 dovecot_plain authenticator failed for ([84.238.92.245]) [84.238.92.245]:50840: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
country_id: 2661886
description:
2025-02-06 15:01:29 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:33660: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.223.193.232
country_id: 597427
description:
2025-02-06 15:01:34 dovecot_login authenticator failed for (88-223-193-232.init.lt) [88.223.193.232]:39325: 535 Incorrect authentication data (set_id=cole@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.100.184.80
country_id: 1880251
description:
2025-02-06 15:01:37 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [101.100.184.80]:56152: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
country_id: 1814991
description:
2025-02-06 15:01:43 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:54248: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
country_id: 1814991
description:
2025-02-06 15:01:47 dovecot_plain authenticator failed for ([116.132.42.170]) [116.132.42.170]:48982: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
country_id: 1562822
description:
2025-02-06 15:02:44 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:4202: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
country_id: 298795
description:
2025-02-06 15:02:47 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:56732: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-06 15:02:54 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:33744: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
country_id: 1149361
description:
2025-02-06 15:02:56 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:42091: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
country_id: 290557
description:
2025-02-06 15:03:02 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:44221: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.4.42.19
country_id: 3175395
description:
2025-02-06 15:02:37 dovecot_plain authenticator failed for (host-194-4-42-19.net.intranetwifi.it) [194.4.42.19]:54360: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
country_id: 3469034
description:
2025-02-06 15:02:31 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:45243: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.209.153
country_id: 1814991
description:
2025-02-06 15:02:35 dovecot_plain authenticator failed for ([39.174.209.153]) [39.174.209.153]:48932: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2025-02-06 15:02:36 dovecot_plain authenticator failed for ([178.178.222.52]) [178.178.222.52]:47702: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
country_id: 6251999
description:
Feb  6 15:02:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.154
country_id: 1668284
description:
Feb  6 15:02:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.170.20
country_id: 2017370
description:
2025-02-06 15:02:46 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:50058: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
country_id: 1668284
description:
2025-02-06 15:02:54 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:42156: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.216
country_id: 3865483
description:
2025-02-06 15:03:06 dovecot_plain authenticator failed for (201-234-106-216.static.impsat.net.ar) [201.234.106.216]:39259: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-06 15:02:32 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:38322: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
country_id: 6252001
description:
2025-02-06 15:02:32 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:55950: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.188.85
country_id: 1814991
description:
2025-02-06 15:02:33 dovecot_plain authenticator failed for ([120.234.188.85]) [120.234.188.85]:15194: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2025-02-06 15:02:36 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:50350: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.226.218.185
country_id: 3865483
description:
2025-02-06 15:02:42 dovecot_plain authenticator failed for 168-226-218-185.static.speedy.com.ar [168.226.218.185]:55780: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
country_id: 1835841
description:
Feb  6 15:02:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-02-06 15:02:25 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:33682: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
country_id: 1835841
description:
2025-02-06 15:02:53 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:44677: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
country_id: 2750405
description:
2025-02-06 15:02:30 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:58802: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.6.225.90
country_id: 1820814
description:
2025-02-06 15:02:30 dovecot_login authenticator failed for (90-225.adsl.static.espeed.com.bn) [61.6.225.90]:54974: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
country_id: 1814991
description:
2025-02-06 15:02:31 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:51657: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
country_id: 1269750
description:
2025-02-06 15:02:34 dovecot_plain authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:55432: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
country_id: 1819730
description:
2025-02-06 15:02:51 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:28075: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
country_id: 1814991
description:
2025-02-06 15:02:24 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:58676: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.209.153
country_id: 1814991
description:
Feb  6 15:02:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.154
country_id: 1668284
description:
2025-02-06 15:02:42 dovecot_plain authenticator failed for 111-70-22-154.emome-ip.hinet.net [111.70.22.154]:41124: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
country_id: 6251999
description:
2025-02-06 15:02:29 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:48602: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
country_id: 1694008
description:
Feb  6 15:02:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2025-02-06 15:02:33 dovecot_plain authenticator failed for ([1.30.20.238]) [1.30.20.238]:52038: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-06 15:02:36 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:52507: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
country_id: 6252001
description:
2025-02-06 15:03:06 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:41022: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.65.162.110
country_id: 2542007
description:
[2025-02-06 15:02:30 +0100] info [webmaild] 196.65.162.110 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
country_id: 2017370
description:
Feb  6 15:02:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
country_id: 1694008
description:
2025-02-06 15:02:35 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:38119: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
country_id: 1814991
description:
2025-02-06 15:02:39 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:44641: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
country_id: 1835841
description:
2025-02-06 15:02:46 dovecot_plain authenticator failed for ([14.35.218.58]) [14.35.218.58]:50833: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.21
country_id: 1269750
description:
2025-02-06 15:02:48 dovecot_plain authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:33524: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.126.81
country_id: 1835841
description:
2025-02-06 15:04:23 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:35530: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
country_id: 1149361
description:
2025-02-06 15:03:54 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:48994: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.210.134.9
country_id: 1814991
description:
2025-02-06 15:04:19 dovecot_plain authenticator failed for ([221.210.134.9]) [221.210.134.9]:48896: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 15:03:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.138.121
country_id: 3469034
description:
[2025-02-06 15:03:48 +0100] info [webmaild] 170.238.138.121 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
country_id: 953987
description:
2025-02-06 15:04:03 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:53674: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.166
country_id: 1668284
description:
2025-02-06 15:04:11 dovecot_plain authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:37174: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
country_id: 2233387
description:
2025-02-06 15:05:12 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:37284: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 146.70.29.197
country_id: 1880251
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-04.146.70.29.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
country_id: 3865483
description:
2025-02-06 15:04:37 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:54458: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.127.50.104
country_id: 1210997
description:
[2025-02-06 15:04:46 +0100] info [webmaild] 45.127.50.104 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 15:04:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
country_id: 2245662
description:
2025-02-06 15:04:59 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:36766: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
country_id: 1835841
description:
2025-02-06 15:04:27 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:37330: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 146.70.29.197
country_id: 1880251
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:15-04.146.70.29.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
country_id: 1814991
description:
2025-02-06 15:05:12 dovecot_login authenticator failed for ([112.25.140.211]) [112.25.140.211]:57871: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2025-02-06 15:05:16 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:49498: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-02-06 15:04:40 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:59910: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
country_id: 1814991
description:
2025-02-06 15:05:55 dovecot_login authenticator failed for (57.252.223.60.adsl-pool.sx.cn) [60.223.252.57]:60592: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
country_id: 1814991
description:
2025-02-06 15:05:25 dovecot_login authenticator failed for ([111.175.39.76]) [111.175.39.76]:49623: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-02-06 15:05:30 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:45096: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
country_id: 298795
description:
2025-02-06 15:05:37 dovecot_login authenticator failed for (95.0.252.72.static.ttnet.com.tr) [95.0.252.72]:58308: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.203.199.50
country_id: 2453866
description:
[2025-02-06 15:05:41 +0100] info [webmaild] 41.203.199.50 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.130.20
country_id: 2077456
description:
2025-02-06 15:05:43 dovecot_login authenticator failed for ([202.62.130.20]) [202.62.130.20]:47809: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.146.138.226
country_id: 1814991
description:
2025-02-06 15:05:50 dovecot_login authenticator failed for ([219.146.138.226]) [219.146.138.226]:48140: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.62.130.20
country_id: 2077456
description:
Feb  6 15:05:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.62.130.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.131.135.251
country_id: 6252001
description:
Feb  6 15:06:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.131.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
country_id: 3175395
description:
2025-02-06 15:07:35 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:39127: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.182
country_id: 1668284
description:
Feb  6 15:07:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.240.129.68
country_id: 1814991
description:
Feb  6 15:07:44 ait sshd[1246226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.240.129.68  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
country_id: 1835841
description:
Feb  6 15:08:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
country_id: 1562822
description:
2025-02-06 15:08:06 dovecot_login authenticator failed for ([171.244.63.170]) [171.244.63.170]:17315: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 15:08:00 ait sshd[1246371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.183.209.179  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
country_id: 1562822
description:
Feb  6 15:08:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
country_id: 2017370
description:
2025-02-06 15:07:45 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:40053: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2025-02-06 15:07:32 dovecot_login authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:39681: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.67.162
country_id: 6252001
description:
2025-02-06 15:07:39 dovecot_login authenticator failed for (ADMIN) [191.96.67.162]:57656: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.96.91.71
country_id: 1269750
description:
2025-02-06 15:07:41 dovecot_login authenticator failed for ([27.96.91.71]) [27.96.91.71]:52732: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.148.163.69
country_id: 1512440
description:
[2025-02-06 15:07:34 +0100] info [webmaild] 31.148.163.69 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.221.48
country_id: 1835841
description:
Feb  6 15:08:15 ait sshd[1246403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.221.48


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.209.179
country_id: 2750405
description:
Feb  6 15:08:00 ait sshd[1246371]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.183.209.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
country_id: 1835841
description:
2025-02-06 15:08:06 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:36458: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.221.48
country_id: 1835841
description:
Feb  6 15:08:15 ait sshd[1246403]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.221.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 15:08:25 ait sshd[1246442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.96.67.162
country_id: 6252001
description:
Feb  6 15:07:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.96.67.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
country_id: 2017370
description:
Feb  6 15:07:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.240.129.68
country_id: 1814991
description:
Feb  6 15:07:44 ait sshd[1246226]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.240.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
country_id: 3175395
description:
Feb  6 15:07:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.96.91.71
country_id: 1269750
description:
Feb  6 15:07:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.96.91.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 15:08:25 ait sshd[1246442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 15:09:04 ait sshd[1246806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
country_id: 2400553
description:
Feb  6 15:09:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
country_id: 1814991
description:
2025-02-06 15:09:21 dovecot_login authenticator failed for ([221.10.221.104]) [221.10.221.104]:46325: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
country_id: 732800
description:
2025-02-06 15:09:21 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:47200: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
country_id: 1835841
description:
2025-02-06 15:08:29 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:46033: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 15:08:41 ait sshd[1246656]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.8.2.70
country_id: 1835841
description:
Feb  6 15:09:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.8.2.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 15:09:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
country_id: 2921044
description:
Feb  6 15:09:04 ait sshd[1246806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.95.195
country_id: 6252001
description:
Feb  6 15:09:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.95.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
country_id: 6252001
description:
Feb  6 15:09:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  6 15:08:27 ait sshd[1246442]: Failed password for invalid user universitypublishing from 175.125.95.234 port 51488 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
country_id: 1814991
description:
Feb  6 15:09:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-06 15:09:23 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:43986: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
country_id: 1835841
description:
Feb  6 15:09:24 ait sshd[1246875]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
country_id: 1835841
description:
Feb  6 15:09:24 ait sshd[1246875]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
country_id: 3996063
description:
2025-02-06 15:09:26 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:41650: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
country_id: 2921044
description:
Feb  6 15:08:41 ait sshd[1246656]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
country_id: 732800
description:
Feb  6 15:09:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
country_id: 1269750
description:
Feb  6 15:09:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.253.119
country_id: 298795
description:
2025-02-06 15:09:13 dovecot_login authenticator failed for ([31.141.253.119]) [31.141.253.119]:60204: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.117.94
country_id: 2510769
description:
Feb  6 15:09:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.117.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
country_id: 1269750
description:
2025-02-06 15:09:23 dovecot_plain authenticator failed for ([103.170.225.80]) [103.170.225.80]:48864: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.117.94
country_id: 2510769
description:
2025-02-06 15:09:25 dovecot_login authenticator failed for ([46.35.117.94]) [46.35.117.94]:54618: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 81.93.79.149
country_id: 3277605
description:
[2025-02-06 15:08:26 +0100] info [webmaild] 81.93.79.149 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  6 15:09:02 ait sshd[1246784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.19.211.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.253.119
country_id: 298795
description:
Feb  6 15:09:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.253.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.19.211.4
country_id: 2635167
description:
Feb  6 15:09:02 ait sshd[1246784]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.19.211.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.2.70
country_id: 1835841
description:
2025-02-06 15:09:04 dovecot_login authenticator failed for ([59.8.2.70]) [59.8.2.70]:53565: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
country_id: 1835841
description:
Feb  6 15:08:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.95.195
country_id: 6252001
description:
2025-02-06 15:09:24 dovecot_plain authenticator failed for ([47.206.95.195]) [47.206.95.195]:33196: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
country_id: 3996063
description:
Feb  6 15:09:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.232.231
country_id: 1814991
description:
Feb  6 15:09:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.232.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
country_id: 1814991
description:
2025-02-06 15:09:44 dovecot_login authenticator failed for ([222.87.49.250]) [222.87.49.250]:55049: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
country_id: 2750405
description:
Feb  6 15:09:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
country_id: 1814991
description:
2025-02-06 15:09:31 dovecot_login authenticator failed for ([39.164.91.67]) [39.164.91.67]:50020: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Feb  6 15:09:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
country_id: 6252001
description:
Feb  6 15:10:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.185.8.165
country_id: 1269750
description:
Feb  6 15:10:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.185.8.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.18.252.107
country_id: 1814991
description:
Feb  6 15:10:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.18.252.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.228.18
country_id: 1835841
description:
2025-02-06 15:09:44 dovecot_plain authenticator failed for ([112.164.228.18]) [112.164.228.18]:47223: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
country_id: 298795
description:
2025-02-06 15:09:56 dovecot_login authenticator failed for ([95.0.252.76]) [95.0.252.76]:55318: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.122
country_id: 1814991
description:
Feb  6 15:09:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.154
country_id: 1668284
description:
2025-02-06 15:09:50 dovecot_login authenticator failed for 111-70-22-154.emome-ip.hinet.net [111.70.22.154]:55185: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-06 15:09:43 dovecot_login authenticator failed for ([41.63.165.61]) [41.63.165.61]:39120: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.179
country_id: 1814991
description:
2025-02-06 15:09:45 dovecot_login authenticator failed for ([182.135.66.179]) [182.135.66.179]:51512: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
country_id: 895949
description:
Feb  6 15:09:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
country_id: 1562822
description:
Feb  6 15:09:55 ait sshd[1247128]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 15:10:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.85.114
country_id: 3469034
description:
Feb  6 15:09:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.85.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
country_id: 2750405
description:
2025-02-06 15:09:29 dovecot_login authenticator failed for d96469c2.static.ziggozakelijk.nl (D96469C3.static.ziggozakelijk.nl) [217.100.105.194]:46765: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.201
country_id: 1819730
description:
2025-02-06 15:09:41 dovecot_login authenticator failed for (m121-202-198-201.smartone.com) [121.202.198.201]:29389: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.169.52
country_id: 1814991
description:
2025-02-06 15:09:30 dovecot_login authenticator failed for ([124.239.169.52]) [124.239.169.52]:53748: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
country_id: 1814991
description:
Feb  6 15:10:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.62
country_id: 1814991
description:
Feb  6 15:10:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.195.198
country_id: 1814991
description:
Feb  6 15:10:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.195.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
country_id: 1814991
description:
Feb  6 15:09:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.239.241.198
country_id: 1814991
description:
2025-02-06 15:09:39 dovecot_plain authenticator failed for ([115.239.241.198]) [115.239.241.198]:35055: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
country_id: 1814991
description:
2025-02-06 15:09:44 dovecot_plain authenticator failed for ([116.112.6.186]) [116.112.6.186]:38436: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.85.114
country_id: 3469034
description:
2025-02-06 15:09:29 dovecot_plain authenticator failed for (189-20-32-73.customer.tdatabrasil.net.br) [186.200.85.114]:56879: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.66.11
country_id: 1210997
description:
[2025-02-06 15:10:01 +0100] info [webmaild] 182.48.66.11 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
country_id: 1562822
description:
Feb  6 15:09:55 ait sshd[1247128]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 15:10:08 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:38095: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.232.231
country_id: 1814991
description:
2025-02-06 15:09:37 dovecot_login authenticator failed for ([27.45.232.231]) [27.45.232.231]:47284: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
country_id: 298795
description:
Feb  6 15:09:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-06 15:09:46 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-173.static.tpgi.com.au) [110.175.220.250]:58903: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
country_id: 1814991
description:
Feb  6 15:09:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.0.126.91
country_id: 3865483
description:
Feb  6 15:09:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.0.126.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.0.126.91
country_id: 3865483
description:
2025-02-06 15:09:48 dovecot_login authenticator failed for 190-0-126-91.sanluisctv.com.ar [190.0.126.91]:36320: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.121.214.105
country_id: 2017370
description:
2025-02-06 15:10:21 dovecot_login authenticator failed for ([176.121.214.105]) [176.121.214.105]:44574: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
country_id: 1814991
description:
2025-02-06 15:09:29 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:37464: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  6 15:09:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
country_id: 1668284
description:
Feb  6 15:09:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
country_id: 1814991
description:
Feb  6 15:09:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
country_id: 1835841
description:
Feb  6 15:10:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.225.252.175
country_id: 3489940
description:
2025-02-06 15:09:35 dovecot_plain authenticator failed for ([173.225.252.175]) [173.225.252.175]:48594: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
country_id: 1814991
description:
Feb  6 15:09:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.206.7.126
country_id: 1814991
description:
2025-02-06 15:09:57 dovecot_login authenticator failed for ([221.206.7.126]) [221.206.7.126]:40959: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Feb  6 15:09:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-02-06 15:10:11 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:56238: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.206.7.126
country_id: 1814991
description:
Feb  6 15:09:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.206.7.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.195.198
country_id: 1814991
description:
2025-02-06 15:10:26 dovecot_login authenticator failed for ([221.10.195.198]) [221.10.195.198]:46171: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  6 15:09:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
country_id: 1861060
description:
Feb  6 15:09:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.22.154
country_id: 1668284
description:
Feb  6 15:09:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.22.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.218.102.225
country_id: 1668284
description:
Feb  6 15:09:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.218.102.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.62
country_id: 1814991
description:
2025-02-06 15:10:25 dovecot_login authenticator failed for ([125.90.72.62]) [125.90.72.62]:56960: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.179
country_id: 1814991
description:
Feb  6 15:09:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
country_id: 1269750
description:
2025-02-06 15:09:43 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:57898: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2025-02-06 15:09:56 dovecot_login authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:52820: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
country_id: 1835841
description:
2025-02-06 15:10:06 dovecot_login authenticator failed for ([222.119.98.157]) [222.119.98.157]:37596: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
country_id: 1814991
description:
Feb  6 15:09:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
country_id: 895949
description:
2025-02-06 15:09:42 dovecot_login authenticator failed for ([165.56.11.206]) [165.56.11.206]:57426: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.102.225
country_id: 1668284
description:
2025-02-06 15:10:00 dovecot_login authenticator failed for (180-218-102-225.dynamic.twmbroadband.net) [180.218.102.225]:39714: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
country_id: 1814991
description:
2025-02-06 15:09:29 dovecot_plain authenticator failed for ([60.213.27.250]) [60.213.27.250]:33014: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
country_id: 1814991
description:
Feb  6 15:09:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.125.146.242
country_id: 6252001
description:
2025-02-06 15:09:49 dovecot_login authenticator failed for ([206.125.146.242]) [206.125.146.242]:40586: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.225.252.175
country_id: 3489940
description:
Feb  6 15:09:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.225.252.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-02-06 15:09:43 dovecot_login authenticator failed for ([46.161.196.5]) [46.161.196.5]:59462: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-02-06 15:09:56 dovecot_login authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:62268: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
country_id: 1210997
description:
2025-02-06 15:10:00 dovecot_login authenticator failed for ([103.231.163.154]) [103.231.163.154]:7543: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-06 15:09:32 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:45091: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
country_id: 1269750
description:
2025-02-06 15:09:36 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:45458: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
country_id: 1269750
description:
Feb  6 15:09:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
country_id: 1814991
description:
2025-02-06 15:10:00 dovecot_login authenticator failed for ([112.48.104.200]) [112.48.104.200]:35381: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.169.52
country_id: 1814991
description:
Feb  6 15:09:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.169.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-06 15:09:33 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:54715: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
country_id: 6252001
description:
2025-02-06 15:10:14 dovecot_login authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:43726: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.44.225
country_id: 6252001
description:
Feb  6 15:10:13 ait sshd[1247589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.161.44.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.8.165
country_id: 1269750
description:
2025-02-06 15:10:18 dovecot_login authenticator failed for (abts-tn-static-165.8.185.136.airtelbroadband.in) [136.185.8.165]:43619: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.228.18
country_id: 1835841
description:
Feb  6 15:09:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.228.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.198.129.123
country_id: 1819730
description:
Feb  6 15:09:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.198.129.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.18.252.107
country_id: 1814991
description:
2025-02-06 15:10:19 dovecot_login authenticator failed for ([14.18.252.107]) [14.18.252.107]:9676: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
country_id: 1814991
description:
Feb  6 15:09:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.233.188
country_id: 2017370
description:
2025-02-06 15:10:01 dovecot_login authenticator failed for ([178.216.233.188]) [178.216.233.188]:43931: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-02-06 15:10:00 dovecot_login authenticator failed for ([195.222.57.182]) [195.222.57.190]:51936: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.161.44.225
country_id: 6252001
description:
Feb  6 15:10:13 ait sshd[1247589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.161.44.225


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
country_id: 1814991
description:
2025-02-06 15:10:17 dovecot_login authenticator failed for ([36.26.63.158]) [36.26.63.158]:58521: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  6 15:09:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.201
country_id: 1819730
description:
Feb  6 15:09:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.161.196.5
country_id: 99237
description:
Feb  6 15:09:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.161.196.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
country_id: 1861060
description:
2025-02-06 15:09:46 dovecot_login authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:52388: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
country_id: 617790
description:
2025-02-06 15:09:33 dovecot_login authenticator failed for ([185.167.56.70]) [185.167.56.70]:46790: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.239.241.198
country_id: 1814991
description:
Feb  6 15:09:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.239.241.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.121.214.105
country_id: 2017370
description:
Feb  6 15:10:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.121.214.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
country_id: 2017370
description:
Feb  6 15:10:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.122
country_id: 1814991
description:
2025-02-06 15:09:48 dovecot_plain authenticator failed for ([61.185.226.122]) [61.185.226.122]:36476: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
country_id: 1210997
description:
Feb  6 15:09:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
country_id: 1835841
description:
Feb  6 15:10:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
country_id: 2017370
description:
2025-02-06 15:10:23 dovecot_login authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:59412: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
country_id: 1269750
description:
Feb  6 15:09:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
country_id: 6252001
description:
2025-02-06 15:09:27 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:55193: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.246.122.82
country_id: 3144096
description:
2025-02-06 15:10:08 dovecot_login authenticator failed for (ADMIN) [46.246.122.82]:58396: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
country_id: 617790
description:
Feb  6 15:09:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
country_id: 1814991
description:
2025-02-06 15:09:43 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:41184: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
country_id: 1835841
description:
Feb  6 15:10:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
country_id: 1835841
description:
2025-02-06 15:10:35 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:53272: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.142.197
country_id: 1814991
description:
Feb  6 15:10:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.142.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
country_id: 1036973
description:
Feb  6 15:10:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.18
country_id: 1814991
description:
2025-02-06 15:10:47 dovecot_login authenticator failed for ([125.90.72.18]) [125.90.72.18]:58168: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.159.91.86
country_id: 3017382
description:
Feb  6 15:10:52 ait sshd[1247836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.159.91.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
country_id: 3508796
description:
2025-02-06 15:10:30 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:47916: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-02-06 15:10:31 dovecot_login authenticator failed for ([165.220.130.160]) [165.220.130.160]:34328: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2025-02-06 15:10:43 dovecot_login authenticator failed for ([197.242.170.10]) [197.242.170.10]:50871: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.18
country_id: 1814991
description:
Feb  6 15:10:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 15:11:04 ait sshd[1247910]: pam_imunify(sshd:auth): [IM360_RBL] The IP 81.241.179.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 81.241.179.229
country_id: 2802361
description:
Feb  6 15:11:04 ait sshd[1247910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=81.241.179.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
country_id: 3508796
description:
Feb  6 15:10:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
country_id: 2510769
description:
Feb  6 15:10:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.142.197
country_id: 1814991
description:
2025-02-06 15:10:40 dovecot_login authenticator failed for ([120.236.142.197]) [120.236.142.197]:48426: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
country_id: 290557
description:
Feb  6 15:10:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.98.106
country_id: 3469034
description:
[2025-02-06 15:10:47 +0100] info [webmaild] 177.73.98.106 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
country_id: 290557
description:
2025-02-06 15:10:48 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:43580: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 122.224.68.163
country_id: 1814991
description:
2025-02-06 15:10:50 H=(mail.bsoft.cloud) [122.224.68.163]:56526 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<xkjrvh@bsoft.cloud> rejected RCPT <E1pvJDf-0007Ln-1b@ait.aitvarsity.net>: Unrouteable address


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.159.91.86
country_id: 3017382
description:
Feb  6 15:10:52 ait sshd[1247836]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.159.91.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.109.30
country_id: 1733045
description:
Feb  6 15:11:39 ait sshd[1248151]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.225.109.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.225.109.30
country_id: 1733045
description:
Feb  6 15:11:39 ait sshd[1248151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.225.109.30


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.79.51
country_id: 3865483
description:
[2025-02-06 15:12:24 +0100] info [webmaild] 181.94.79.51 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.133.195
country_id: 6252001
description:
Feb  6 15:11:27 ait sshd[1247979]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.133.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.133.195
country_id: 6252001
description:
Feb  6 15:11:27 ait sshd[1247979]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.133.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.220.203
country_id: 3469034
description:
[2025-02-06 15:11:30 +0100] info [webmaild] 177.185.220.203 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.253.28.238
country_id: 1835841
description:
Feb  6 15:12:31 ait sshd[1248304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.253.28.238


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 15:12:34 ait sshd[1248453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-12.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.28.238
country_id: 1835841
description:
Feb  6 15:12:31 ait sshd[1248304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.253.28.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
country_id: 1269750
description:
Feb  6 15:12:34 ait sshd[1248453]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.150.2
country_id: 6252001
description:
2025-02-06 15:13:45 dovecot_login authenticator failed for 2.sub-166-139-150.myvzw.com [166.139.150.2]:50094: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
country_id: 2750405
description:
Feb  6 15:13:55 ait sshd[1248966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.30.53
country_id: 3469034
description:
[2025-02-06 15:14:13 +0100] info [webmaild] 45.173.30.53 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 15:13:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  6 15:13:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-13.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.150.2
country_id: 6252001
description:
Feb  6 15:13:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.150.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.76.127
country_id: 1835841
description:
2025-02-06 15:13:55 dovecot_login authenticator failed for ([183.107.76.127]) [183.107.76.127]:50269: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 15:14:13 ait sshd[1249053]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
country_id: 2750405
description:
Feb  6 15:13:55 ait sshd[1248966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.76.127
country_id: 1835841
description:
Feb  6 15:13:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.76.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
country_id: 2921044
description:
Feb  6 15:14:13 ait sshd[1249053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
country_id: 1562822
description:
Feb  6 15:14:34 ait sshd[1249220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.165.222
country_id: 99237
description:
[2025-02-06 15:14:48 +0100] info [webmaild] 151.236.165.222 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 15:15:03 ait sshd[1249601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 15:15:23 ait sshd[1249642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.183.167.41


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
country_id: 1562822
description:
Feb  6 15:14:34 ait sshd[1249220]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 15:14:45 ait sshd[1249269]: pam_imunify(sshd:auth): [IM360_RBL] The IP 208.109.10.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 15:15:23 ait sshd[1249642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.183.167.41 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 208.109.10.69
country_id: 1880251
description:
Feb  6 15:14:45 ait sshd[1249269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=208.109.10.69


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
country_id: 6251999
description:
Feb  6 15:15:03 ait sshd[1249601]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 202.183.167.41
country_id: 1605651
description:
Feb  6 15:15:24 ait sshd[1249642]: Failed password for invalid user goudirect from 202.183.167.41 port 39124 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.109.114.136
country_id: 2589581
description:
[2025-02-06 15:15:28 +0100] info [webmaild] 105.109.114.136 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.35.231
country_id: 3469034
description:
[2025-02-06 15:16:21 +0100] info [webmaild] 45.181.35.231 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
country_id: 1835841
description:
2025-02-06 15:16:28 dovecot_login authenticator failed for ([211.243.43.30]) [211.243.43.30]:40136: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
country_id: 1835841
description:
Feb  6 15:16:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
country_id: 6252001
description:
Feb  6 15:17:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.30
country_id: 1835841
description:
Feb  6 15:16:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
country_id: 1835841
description:
Feb  6 15:16:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  6 15:16:37 ait sshd[1250168]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.120.215 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 113.181.178.241
country_id: 1562822
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-16.113.181.178.241


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 15:17:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  6 15:16:37 ait sshd[1250168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.120.215


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
country_id: 1668284
description:
Feb  6 15:16:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
country_id: 1668284
description:
2025-02-06 15:16:51 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:48224: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.18.55.49
country_id: 1269750
description:
Feb  6 15:17:13 ait sshd[1250308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.18.55.49


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
country_id: 6252001
description:
2025-02-06 15:17:17 dovecot_plain authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:38090: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
country_id: 1835841
description:
2025-02-06 15:16:38 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:58709: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
country_id: 1835841
description:
2025-02-06 15:16:38 dovecot_login authenticator failed for ([1.241.64.92]) [1.241.64.92]:44635: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.18.55.49
country_id: 1269750
description:
Feb  6 15:17:13 ait sshd[1250308]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.18.55.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
country_id: 6252001
description:
Feb  6 15:17:39 ait sshd[1250622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
country_id: 2264397
description:
2025-02-06 15:18:21 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (hycnessing) [89.153.62.100]:42318: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.161.68
country_id: 99237
description:
Feb  6 15:17:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.161.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.68
country_id: 99237
description:
2025-02-06 15:17:27 dovecot_plain authenticator failed for ([65.20.161.68]) [65.20.161.68]:42725: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
country_id: 2264397
description:
Feb  6 15:18:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
country_id: 6252001
description:
Feb  6 15:17:39 ait sshd[1250622]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.137.175.225
country_id: 3469034
description:
[2025-02-06 15:18:09 +0100] info [webmaild] 143.137.175.225 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.53.216.56
country_id: 2017370
description:
[2025-02-06 15:18:56 +0100] info [webmaild] 84.53.216.56 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-19.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 15:18:41 ait sshd[1251108]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 15:18:41 ait sshd[1251102]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  6 15:18:41 ait sshd[1251102]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
country_id: 3144096
description:
Feb  6 15:18:41 ait sshd[1251108]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-06 15:19:58 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (dehoberly) [80.14.31.158]:42312: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.86.135.179
country_id: 3585968
description:
[2025-02-06 15:19:42 +0100] info [webmaild] 190.86.135.179 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 15:19:44 ait sshd[1251459]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  6 15:19:44 ait sshd[1251459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
country_id: 3469034
description:
2025-02-06 15:19:45 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:45807: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.244.83.178
country_id: 2661886
description:
Feb  6 15:19:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.244.83.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
country_id: 3469034
description:
Feb  6 15:19:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
country_id: 2661886
description:
2025-02-06 15:19:53 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:41358: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
country_id: 3017382
description:
Feb  6 15:19:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.26.221.84
country_id: 1269750
description:
2025-02-06 15:20:34 dovecot_login authenticator failed for (ADMIN) [23.26.221.84]:57530: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.174.35
country_id: 1269750
description:
2025-02-06 15:20:53 dovecot_plain authenticator failed for ([122.186.174.35]) [122.186.174.35]:50998: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.175.152.141
country_id: 3469034
description:
[2025-02-06 15:20:36 +0100] info [webmaild] 179.175.152.141 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
country_id: 1819730
description:
Feb  6 15:20:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
country_id: 1819730
description:
2025-02-06 15:20:40 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:49086: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.26.221.84
country_id: 1269750
description:
Feb  6 15:20:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.26.221.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.186.174.35
country_id: 1269750
description:
Feb  6 15:20:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.186.174.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
country_id: 6252001
description:
2025-02-06 15:21:35 dovecot_plain authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:62220: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
country_id: 6252001
description:
Feb  6 15:21:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
country_id: 617790
description:
2025-02-06 15:22:02 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:37128: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 15:22:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.62.18.53
country_id: 3439705
description:
[2025-02-06 15:22:15 +0100] info [webmaild] 167.62.18.53 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
country_id: 6252001
description:
2025-02-06 15:21:42 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:59436: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.235.5
country_id: 6252001
description:
Feb  6 15:21:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.235.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.5
country_id: 6252001
description:
2025-02-06 15:21:49 dovecot_plain authenticator failed for ([104.241.235.5]) [104.241.235.5]:32963: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
country_id: 617790
description:
Feb  6 15:22:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.174.103.74
country_id: 6252001
description:
Feb  6 15:21:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.174.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
country_id: 3996063
description:
2025-02-06 15:22:32 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:49693: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
country_id: 1835841
description:
Feb  6 15:22:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.168.226
country_id: 3469034
description:
2025-02-06 15:22:56 dovecot_plain authenticator failed for (200-217-53-25.host.telemar.net.br) [200.216.168.226]:60869: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.123.80
country_id: 1814991
description:
2025-02-06 15:22:37 dovecot_plain authenticator failed for ([112.91.123.80]) [112.91.123.80]:41580: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.127.197.89
country_id: 3469034
description:
2025-02-06 15:23:12 dovecot_plain authenticator failed for (179.127.197.89.afinet.com.br) [179.127.197.89]:53853: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
country_id: 3996063
description:
Feb  6 15:22:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.216.168.226
country_id: 3469034
description:
Feb  6 15:22:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.216.168.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
country_id: 1269750
description:
Feb  6 15:22:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
country_id: 1269750
description:
2025-02-06 15:22:57 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:38778: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.123.80
country_id: 1814991
description:
Feb  6 15:22:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.123.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
country_id: 1835841
description:
2025-02-06 15:22:43 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:37160: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.189.110.82
country_id: 2017370
description:
[2025-02-06 15:23:04 +0100] info [webmaild] 89.189.110.82 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.127.197.89
country_id: 3469034
description:
Feb  6 15:23:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.127.197.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 15:24:14 ait sshd[1253449]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.237.199 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.137.180.48
country_id: 3865483
description:
[2025-02-06 15:23:37 +0100] info [webmaild] 186.137.180.48 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  6 15:23:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
country_id: 1814991
description:
Feb  6 15:23:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
country_id: 1814991
description:
2025-02-06 15:23:37 dovecot_login authenticator failed for ([36.134.78.151]) [36.134.78.151]:54712: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.73.70.43
country_id: 2661886
description:
Feb  6 15:23:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.73.70.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.73.70.43
country_id: 2661886
description:
2025-02-06 15:23:44 dovecot_login authenticator failed for 78-73-70-43-no600.tbcn.telia.com [78.73.70.43]:44648: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.237.199
country_id: 6252001
description:
Feb  6 15:24:14 ait sshd[1253449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.237.199  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 15:24:26 ait sshd[1253472]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
country_id: 294640
description:
Feb  6 15:25:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
country_id: 294640
description:
2025-02-06 15:25:03 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:57644: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-02-06 15:25:12 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:46852: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.248.251
country_id: 2661886
description:
Feb  6 15:24:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.248.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.248.251
country_id: 2661886
description:
2025-02-06 15:24:52 dovecot_plain authenticator failed for c188-148-248-251.bredband.tele2.se (quing) [188.148.248.251]:58648: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
country_id: 1269750
description:
Feb  6 15:25:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
country_id: 1835841
description:
Feb  6 15:25:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.52
country_id: 1819730
description:
Feb  6 15:25:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.52
country_id: 1819730
description:
2025-02-06 15:25:17 dovecot_plain authenticator failed for (m121-202-154-52.smartone.com) [121.202.154.52]:13917: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2025-02-06 15:25:25 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:45453: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
country_id: 2215636
description:
Feb  6 15:24:26 ait sshd[1253472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.125.163.199
country_id: 298795
description:
[2025-02-06 15:24:29 +0100] info [webmaild] 188.125.163.199 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 15:25:34 ait sshd[1254178]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-26.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
country_id: 3469034
description:
2025-02-06 15:25:27 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:41562: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
country_id: 1605651
description:
Feb  6 15:25:34 ait sshd[1254178]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.172.131
country_id: 298795
description:
2025-02-06 15:26:22 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:36314: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
country_id: 3469034
description:
Feb  6 15:25:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 15:26:03 ait sshd[1254426]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 15:26:22 ait sshd[1254541]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
country_id: 2510769
description:
Feb  6 15:26:03 ait sshd[1254426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.172.131
country_id: 298795
description:
Feb  6 15:26:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.172.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 15:25:28 ait sshd[1254155]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
country_id: 1269750
description:
Feb  6 15:25:28 ait sshd[1254155]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
country_id: 2750405
description:
Feb  6 15:26:22 ait sshd[1254541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.139.245
country_id: 3469034
description:
[2025-02-06 15:26:28 +0100] info [webmaild] 177.37.139.245 - customer@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.251.202.80
country_id: 1835841
description:
Feb  6 15:27:07 ait sshd[1254863]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.251.202.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.195.66
country_id: 1269750
description:
2025-02-06 15:27:12 dovecot_login authenticator failed for ([203.129.195.66]) [203.129.195.66]:54223: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
country_id: 6252001
description:
Feb  6 15:27:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.251.202.80
country_id: 1835841
description:
Feb  6 15:27:07 ait sshd[1254863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.251.202.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
country_id: 1835841
description:
Feb  6 15:26:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.135.95.205
country_id: 953987
description:
[2025-02-06 15:27:16 +0100] info [webmaild] 41.135.95.205 - customer@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
country_id: 1835841
description:
2025-02-06 15:26:38 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:49546: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.153.108
country_id: 1814991
description:
Feb  6 15:28:00 ait sshd[1255380]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.12.153.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.27.5
country_id: 1880251
description:
Feb  6 15:27:28 ait sshd[1254960]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.27.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.27.5
country_id: 1880251
description:
Feb  6 15:27:28 ait sshd[1254960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.27.5


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.244.49.91
country_id: 1668284
description:
2025-02-06 15:27:37 dovecot_login authenticator failed for (ADMIN) [173.244.49.91]:64593: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-02-06 15:27:49 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:33100: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
country_id: 2510769
description:
2025-02-06 15:28:06 dovecot_login authenticator failed for ([165.220.130.160]) [165.220.130.160]:42686: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Feb  6 15:27:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-02-06 15:27:26 dovecot_login authenticator failed for (node12.vindb.org) [104.236.145.128]:34141: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.130.70.80
country_id: 6252001
description:
Feb  6 15:27:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.130.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
country_id: 1814991
description:
2025-02-06 15:27:42 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:2612: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.130.70.80
country_id: 6252001
description:
2025-02-06 15:27:31 dovecot_plain authenticator failed for mobile-166-130-70-80.mycingular.net [166.130.70.80]:53602: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
country_id: 1814991
description:
Feb  6 15:27:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 15:27:50 ait sshd[1255265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.149.139 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.12.153.108
country_id: 1814991
description:
Feb  6 15:28:00 ait sshd[1255380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.12.153.108


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.116.15.119
country_id: 2542007
description:
[2025-02-06 15:27:48 +0100] info [webmaild] 196.116.15.119 - customer@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.149.139
country_id: 1880251
description:
Feb  6 15:27:50 ait sshd[1255265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.149.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
country_id: 2510769
description:
Feb  6 15:28:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.166.73
country_id: 1814991
description:
Feb  6 15:28:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.166.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
country_id: 1819730
description:
Feb  6 15:28:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 15:28:41 ait sshd[1255622]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 15:28:47 ait sshd[1255669]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=4.240.73.64  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-28.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.166.73
country_id: 1814991
description:
2025-02-06 15:28:38 dovecot_plain authenticator failed for ([117.158.166.73]) [117.158.166.73]:40390: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
country_id: 2921044
description:
Feb  6 15:28:41 ait sshd[1255622]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.138.227.12
country_id: 1210997
description:
[2025-02-06 15:28:42 +0100] info [webmaild] 103.138.227.12 - customer@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.240.73.64
country_id: 1269750
description:
Feb  6 15:28:47 ait sshd[1255669]: pam_imunify(sshd:auth): [IM360_RBL] The IP 4.240.73.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
country_id: 1819730
description:
2025-02-06 15:28:49 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:28597: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
country_id: 1835841
description:
Feb  6 15:29:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
country_id: 3175395
description:
Feb  6 15:29:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.158.171.3
country_id: 1814991
description:
Feb  6 15:29:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.158.171.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
country_id: 2658434
description:
Feb  6 15:29:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Feb  6 15:29:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
country_id: 1814991
description:
2025-02-06 15:29:46 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:38312: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2025-02-06 15:29:30 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:55938: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
country_id: 2658434
description:
2025-02-06 15:29:30 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:36757: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2025-02-06 15:29:36 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:32939: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.77.97.146
country_id: 1562822
description:
Feb  6 15:29:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.77.97.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.77.97.146
country_id: 1562822
description:
2025-02-06 15:29:49 dovecot_plain authenticator failed for (adsl.viettel.vn) [115.77.97.146]:58751: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
country_id: 3175395
description:
2025-02-06 15:30:07 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:55579: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
country_id: 6252001
description:
Feb  6 15:29:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
country_id: 1835841
description:
2025-02-06 15:29:31 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:53722: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
country_id: 3175395
description:
2025-02-06 15:29:40 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:39962: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
country_id: 1835841
description:
2025-02-06 15:30:44 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:54724: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-06 15:30:57 dovecot_login authenticator failed for (cust61-165.63.41.tvcabo.ao) [41.63.165.61]:61898: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.252.95.28
country_id: 1210997
description:
[2025-02-06 15:30:27 +0100] info [webmaild] 182.252.95.28 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
country_id: 1835841
description:
Feb  6 15:30:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2025-02-06 15:30:43 dovecot_plain authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:46320: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
country_id: 1835841
description:
Feb  6 15:30:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
country_id: 1835841
description:
2025-02-06 15:30:54 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:35708: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  6 15:30:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.209.48
country_id: 3469034
description:
Feb  6 15:30:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.209.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
country_id: 1668284
description:
2025-02-06 15:32:10 dovecot_plain authenticator failed for 111-70-49-185.emome-ip.hinet.net [111.70.49.185]:42438: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.212.19.9
country_id: 1835841
description:
2025-02-06 15:32:13 dovecot_plain authenticator failed for ([116.212.19.9]) [116.212.19.9]:37028: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
country_id: 1814991
description:
2025-02-06 15:32:16 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:39125: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.148.98.11
country_id: 6252001
description:
2025-02-06 15:32:17 dovecot_plain authenticator failed for ([24.148.98.11]) [24.148.98.11]:41698: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2025-02-06 15:31:55 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:60409: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
country_id: 1835841
description:
Feb  6 15:31:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.185
country_id: 1668284
description:
Feb  6 15:32:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.169.113
country_id: 2635167
description:
Feb  6 15:31:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.169.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.236.213.190
country_id: 3469034
description:
2025-02-06 15:31:54 dovecot_plain authenticator failed for 179-236-213-190.user.veloxzone.com.br [179.236.213.190]:39164: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.47.190
country_id: 99237
description:
Feb  6 15:32:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.47.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.47.190
country_id: 99237
description:
2025-02-06 15:32:07 dovecot_plain authenticator failed for ([185.255.47.190]) [185.255.47.190]:54512: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
country_id: 1880251
description:
2025-02-06 15:32:15 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4278: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.148.98.11
country_id: 6252001
description:
Feb  6 15:32:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.148.98.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
country_id: 6252001
description:
Feb  6 15:32:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
country_id: 1814991
description:
2025-02-06 15:32:22 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:42288: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
country_id: 6252001
description:
2025-02-06 15:32:24 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:34779: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
country_id: 1819730
description:
2025-02-06 15:32:00 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:61724: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
country_id: 1835841
description:
2025-02-06 15:32:01 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:35014: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.212.19.9
country_id: 1835841
description:
Feb  6 15:32:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.212.19.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.236.213.190
country_id: 3469034
description:
Feb  6 15:31:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.236.213.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
country_id: 2077456
description:
Feb  6 15:31:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
country_id: 1819730
description:
Feb  6 15:31:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
country_id: 2077456
description:
2025-02-06 15:31:58 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:48716: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
country_id: 1880251
description:
Feb  6 15:32:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.31.103.7
country_id: 3469034
description:
[2025-02-06 15:31:39 +0100] info [webmaild] 189.31.103.7 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-31.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
country_id: 1814991
description:
Feb  6 15:32:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.152
country_id: 294640
description:
Feb  6 15:33:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
country_id: 614540
description:
Feb  6 15:33:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.202.80.152
country_id: 1835841
description:
Feb  6 15:33:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.202.80.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.53.94.242
country_id: 1269750
description:
2025-02-06 15:33:15 dovecot_plain authenticator failed for (www.nettlinx.com) [202.53.94.242]:48816: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  6 15:33:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-06 15:33:21 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:34974: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-02-06 15:33:12 dovecot_plain authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:38175: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  6 15:33:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.98
country_id: 6252001
description:
Feb  6 15:33:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
country_id: 294640
description:
Feb  6 15:33:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.108.112.193
country_id: 3469034
description:
Feb  6 15:33:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.108.112.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-02-06 15:33:13 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:64998: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.122.48.91
country_id: 1814991
description:
Feb  6 15:33:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.122.48.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.164.190
country_id: 2017370
description:
2025-02-06 15:33:14 dovecot_plain authenticator failed for (sogaz-gw.irkutsk.gldn.net) [195.239.164.190]:48273: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
country_id: 614540
description:
Feb  6 15:33:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
country_id: 1814991
description:
Feb  6 15:33:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
country_id: 294640
description:
2025-02-06 15:33:13 dovecot_plain authenticator failed for ([130.185.96.125]) [130.185.96.125]:35688: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
country_id: 1668284
description:
2025-02-06 15:33:16 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:33592: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
country_id: 1814991
description:
2025-02-06 15:33:18 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:59051: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 15:33:03 ait sshd[1257578]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.227.2.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.216.120.234
country_id: 6252001
description:
2025-02-06 15:33:13 dovecot_plain authenticator failed for 76-216-120-234.lightspeed.tukrga.sbcglobal.net [76.216.120.234]:46478: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
country_id: 1814991
description:
Feb  6 15:33:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
country_id: 1814991
description:
2025-02-06 15:33:16 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:49628: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.165.203
country_id: 1814991
description:
2025-02-06 15:33:18 dovecot_plain authenticator failed for ([183.236.165.203]) [183.236.165.203]:54694: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.21.148
country_id: 1835841
description:
2025-02-06 15:33:25 dovecot_plain authenticator failed for ([221.167.21.148]) [221.167.21.148]:35290: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
country_id: 3017382
description:
2025-02-06 15:33:17 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:38378: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
country_id: 1814991
description:
2025-02-06 15:33:20 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:50436: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
country_id: 1835841
description:
2025-02-06 15:33:21 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:40703: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.28.51
country_id: 1814991
description:
Feb  6 15:33:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.28.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-06 15:33:14 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:49770: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2025-02-06 15:33:15 dovecot_plain authenticator failed for ([114.202.80.152]) [114.202.80.152]:50180: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
country_id: 1835841
description:
Feb  6 15:33:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.108.112.193
country_id: 3469034
description:
2025-02-06 15:33:14 dovecot_plain authenticator failed for 131.108.112.193.pontonetassai.com.br [131.108.112.193]:47968: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
country_id: 1814991
description:
Feb  6 15:33:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
country_id: 2510769
description:
2025-02-06 15:33:12 dovecot_plain authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:47160: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.189.234.37
country_id: 1643084
description:
2025-02-06 15:33:16 dovecot_plain authenticator failed for (ip103-189-234-37.cloudhost.web.id) [103.189.234.37]:58760: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.227.2.181
country_id: 1814991
description:
Feb  6 15:33:03 ait sshd[1257578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.227.2.181


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.216.120.234
country_id: 6252001
description:
Feb  6 15:33:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.216.120.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.239.164.190
country_id: 2017370
description:
Feb  6 15:33:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.239.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-02-06 15:33:12 dovecot_plain authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:51090: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
country_id: 2661886
description:
Feb  6 15:33:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
country_id: 1668284
description:
Feb  6 15:33:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.28.51
country_id: 1814991
description:
2025-02-06 15:33:14 dovecot_plain authenticator failed for ([222.128.28.51]) [222.128.28.51]:29542: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
country_id: 1269750
description:
2025-02-06 15:33:15 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:38888: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
country_id: 337996
description:
Feb  6 15:33:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.143.30.155
country_id: 1814991
description:
Feb  6 15:33:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.143.30.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 15:33:25 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:55540: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.158.55.193
country_id: 6251999
description:
Feb  6 15:33:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.158.55.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.53.187
country_id: 1269750
description:
Feb  6 15:33:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.53.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
country_id: 1835841
description:
Feb  6 15:33:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
country_id: 3017382
description:
Feb  6 15:33:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.122.48.91
country_id: 1814991
description:
2025-02-06 15:33:16 dovecot_plain authenticator failed for ([124.206.196.124]) [123.122.48.91]:36710: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
country_id: 2215636
description:
2025-02-06 15:33:19 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:39876: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
country_id: 1814991
description:
2025-02-06 15:33:20 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:49727: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
country_id: 798544
description:
Feb  6 15:33:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.167.21.148
country_id: 1835841
description:
Feb  6 15:33:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.167.21.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
country_id: 2661886
description:
2025-02-06 15:33:11 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:55055: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
country_id: 1835841
description:
Feb  6 15:33:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.158.55.193
country_id: 6251999
description:
2025-02-06 15:33:13 dovecot_plain authenticator failed for (193.55.158.104.in-addr.arpa) [104.158.55.193]:52630: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.72.99
country_id: 1269750
description:
Feb  6 15:33:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.72.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
country_id: 2029969
description:
Feb  6 15:33:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.165.203
country_id: 1814991
description:
Feb  6 15:33:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.165.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
country_id: 1835841
description:
2025-02-06 15:33:16 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:47546: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.72.99
country_id: 1269750
description:
2025-02-06 15:33:17 dovecot_plain authenticator failed for ([152.52.72.99]) [152.52.72.99]:57175: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
country_id: 1814991
description:
Feb  6 15:33:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-06 15:33:19 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:14862: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-06 15:33:20 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:32861: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
country_id: 2017370
description:
Feb  6 15:33:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.53.94.242
country_id: 1269750
description:
Feb  6 15:33:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.53.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2025-02-06 15:33:12 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:47150: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.189.234.37
country_id: 1643084
description:
Feb  6 15:33:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.189.234.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
country_id: 1814991
description:
Feb  6 15:33:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
country_id: 2215636
description:
Feb  6 15:33:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
country_id: 2029969
description:
2025-02-06 15:33:18 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:39554: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  6 15:33:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
country_id: 798544
description:
2025-02-06 15:33:24 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:58592: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
country_id: 6252001
description:
Feb  6 15:33:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
country_id: 1819730
description:
2025-02-06 15:33:28 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:18893: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
country_id: 1668284
description:
2025-02-06 15:33:31 dovecot_plain authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:44402: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-06 15:33:33 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:26023: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
country_id: 2017370
description:
Feb  6 15:33:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.7.135.13
country_id: 1814991
description:
Feb  6 15:33:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.7.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
country_id: 1814991
description:
2025-02-06 15:33:26 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:58596: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-06 15:33:28 dovecot_plain authenticator failed for ([58.216.101.162]) [58.216.101.162]:54833: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
country_id: 3277605
description:
Feb  6 15:33:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  6 15:33:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  6 15:33:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
country_id: 1835841
description:
2025-02-06 15:33:42 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:58976: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  6 15:33:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.170.5.210
country_id: 1814991
description:
Feb  6 15:33:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.170.5.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  6 15:33:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
country_id: 1814991
description:
2025-02-06 15:33:27 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:37687: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.166
country_id: 1835841
description:
Feb  6 15:33:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
country_id: 1814991
description:
Feb  6 15:33:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.10.16.64
country_id: 298795
description:
[2025-02-06 15:33:34 +0100] info [webmaild] 95.10.16.64 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
country_id: 1668284
description:
Feb  6 15:33:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
country_id: 1814991
description:
2025-02-06 15:33:33 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:32910: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-06 15:33:37 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:46450: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
country_id: 1835841
description:
Feb  6 15:33:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.228.181.34
country_id: 3573345
description:
2025-02-06 15:33:39 dovecot_plain authenticator failed for ([207.228.181.34]) [207.228.181.34]:52271: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 15:34:02 ait sshd[1257991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.0.30


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
country_id: 1814991
description:
Feb  6 15:33:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 15:34:02 ait sshd[1258001]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
country_id: 1835841
description:
Feb  6 15:33:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
country_id: 1835841
description:
2025-02-06 15:33:36 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:32789: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.255.239
country_id: 1814991
description:
2025-02-06 15:33:40 dovecot_plain authenticator failed for ([117.69.255.239]) [117.69.255.239]:52467: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
country_id: 3469034
description:
Feb  6 15:33:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
country_id: 1880251
description:
Feb  6 15:33:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
country_id: 1814991
description:
2025-02-06 15:33:52 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:55777: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
country_id: 1831722
description:
Feb  6 15:34:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.39.161
country_id: 1880251
description:
47.128.39.161 - - [06/Feb/2025:15:34:22 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=33054404 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=121%2C95&instructor=1%2C2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.39.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-06 15:33:28 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:60198: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
country_id: 1814991
description:
2025-02-06 15:33:29 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:40036: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
country_id: 2017370
description:
Feb  6 15:33:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.42.62
country_id: 1814991
description:
2025-02-06 15:33:33 dovecot_plain authenticator failed for ([27.115.42.62]) [27.115.42.62]:39177: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-02-06 15:33:55 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:37622: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
country_id: 298795
description:
Feb  6 15:33:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 38.62.224.40
country_id: 6252001
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-33.38.62.224.40


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
country_id: 1835841
description:
2025-02-06 15:33:38 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:52446: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
country_id: 1819730
description:
Feb  6 15:33:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.178.90
country_id: 1835841
description:
2025-02-06 15:33:28 dovecot_plain authenticator failed for ([14.49.178.90]) [14.49.178.90]:49914: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
country_id: 1835841
description:
Feb  6 15:33:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
country_id: 1814991
description:
2025-02-06 15:34:24 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:29505: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
country_id: 298795
description:
2025-02-06 15:33:29 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:49622: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.233.188
country_id: 2017370
description:
2025-02-06 15:33:38 dovecot_plain authenticator failed for ([178.216.233.188]) [178.216.233.188]:52399: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.35.217.44
country_id: 3175395
description:
Feb  6 15:33:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.35.217.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
country_id: 2017370
description:
2025-02-06 15:34:00 dovecot_plain authenticator failed for ([92.124.143.165]) [92.124.143.165]:44619: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
country_id: 1814991
description:
Feb  6 15:34:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Feb  6 15:33:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-06 15:33:32 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:55907: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.87.237
country_id: 1814991
description:
Feb  6 15:33:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.87.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.87.237
country_id: 1814991
description:
2025-02-06 15:33:38 dovecot_plain authenticator failed for ([61.150.87.237]) [61.150.87.237]:46142: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
country_id: 1835841
description:
2025-02-06 15:34:04 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:43361: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.132.232
country_id: 6252001
description:
2025-02-06 15:33:37 dovecot_plain authenticator failed for ([75.110.132.232]) [75.110.132.232]:62518: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.166
country_id: 1835841
description:
2025-02-06 15:33:39 dovecot_plain authenticator failed for ([218.149.228.166]) [218.149.228.166]:59194: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.220.196
country_id: 2017370
description:
Feb  6 15:33:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.220.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.220.196
country_id: 2017370
description:
2025-02-06 15:33:55 dovecot_plain authenticator failed for ([95.221.220.196]) [95.221.220.196]:59252: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
country_id: 1831722
description:
2025-02-06 15:34:10 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:59242: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
country_id: 1814991
description:
Feb  6 15:33:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.110.132.232
country_id: 6252001
description:
Feb  6 15:33:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.110.132.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-06 15:34:00 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:38514: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-06 15:33:36 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:49960: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.255.239
country_id: 1814991
description:
Feb  6 15:33:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.255.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
country_id: 6252001
description:
Feb  6 15:33:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.180.193.176
country_id: 6252001
description:
2025-02-06 15:33:36 dovecot_plain authenticator failed for wsip-184-180-193-176.tu.ok.cox.net [184.180.193.176]:50373: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
country_id: 3175395
description:
Feb  6 15:33:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.178.90
country_id: 1835841
description:
Feb  6 15:33:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.178.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-02-06 15:33:32 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:48064: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  6 15:33:45 ait sshd[1257815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.178.200.239


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-02-06 15:33:33 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:58660: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2025-02-06 15:33:33 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:58606: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
country_id: 99237
description:
2025-02-06 15:33:34 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:40214: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.178.200.239
country_id: 6252001
description:
Feb  6 15:33:45 ait sshd[1257815]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.178.200.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  6 15:33:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-02-06 15:33:26 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:51926: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
country_id: 6252001
description:
2025-02-06 15:33:30 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:43152: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.180.193.176
country_id: 6252001
description:
Feb  6 15:33:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.180.193.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.233.188
country_id: 2017370
description:
Feb  6 15:33:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.233.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.35.217.44
country_id: 3175395
description:
2025-02-06 15:33:54 dovecot_plain authenticator failed for net-2-35-217-44.cust.vodafonedsl.it [2.35.217.44]:41092: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
country_id: 1814991
description:
Feb  6 15:33:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.228.181.34
country_id: 3573345
description:
Feb  6 15:33:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.228.181.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
country_id: 1835841
description:
Feb  6 15:34:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
country_id: 6252001
description:
Feb  6 15:33:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
country_id: 3175395
description:
2025-02-06 15:33:48 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:41284: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
country_id: 3469034
description:
2025-02-06 15:33:28 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:16009: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
country_id: 1814991
description:
2025-02-06 15:33:30 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:49555: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
country_id: 99237
description:
Feb  6 15:33:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.185.204.10
country_id: 6252001
description:
Feb  6 15:33:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.185.204.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-06 15:34:11 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:43178: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.185.204.10
country_id: 6252001
description:
2025-02-06 15:33:32 dovecot_plain authenticator failed for syn-107-185-204-010.res.spectrum.com [107.185.204.10]:55852: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.170.5.210
country_id: 1814991
description:
2025-02-06 15:33:36 dovecot_plain authenticator failed for ([39.170.5.210]) [39.170.5.210]:36046: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
country_id: 1814991
description:
2025-02-06 15:33:39 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:41752: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
country_id: 2017370
description:
2025-02-06 15:33:45 dovecot_plain authenticator failed for ([89.175.253.49]) [89.175.253.49]:49858: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
country_id: 1814991
description:
Feb  6 15:33:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
country_id: 6252001
description:
2025-02-06 15:33:37 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:48250: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
country_id: 290557
description:
2025-02-06 15:33:50 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:36362: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.143.165
country_id: 2017370
description:
Feb  6 15:33:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.143.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.0.30
country_id: 1880251
description:
Feb  6 15:34:02 ait sshd[1257991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.0.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
country_id: 3469034
description:
Feb  6 15:33:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
country_id: 6252001
description:
2025-02-06 15:33:34 dovecot_plain authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:56788: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
country_id: 3017382
description:
Feb  6 15:34:02 ait sshd[1258001]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
country_id: 3469034
description:
Feb  6 15:34:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.42.62
country_id: 1814991
description:
Feb  6 15:33:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.42.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
country_id: 3469034
description:
2025-02-06 15:33:47 dovecot_plain authenticator failed for (biophormula.static.gvt.net.br) [186.215.107.189]:56585: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
country_id: 290557
description:
Feb  6 15:33:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
country_id: 1814991
description:
Feb  6 15:33:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.7.135.13
country_id: 1814991
description:
2025-02-06 15:33:47 dovecot_plain authenticator failed for ([119.7.135.13]) [119.7.135.13]:54940: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
country_id: 6252001
description:
Feb  6 15:34:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.161.14.83
country_id: 3996063
description:
Feb  6 15:34:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.161.14.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
country_id: 1269750
description:
Feb  6 15:35:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
country_id: 6252001
description:
2025-02-06 15:34:38 dovecot_login authenticator failed for ([158.140.38.21]) [158.140.38.21]:54709: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.200.38.83
country_id: 1210997
description:
[2025-02-06 15:34:55 +0100] info [webmaild] 103.200.38.83 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
country_id: 1269750
description:
2025-02-06 15:35:21 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:53716: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  6 15:35:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
country_id: 3996063
description:
2025-02-06 15:34:50 dovecot_login authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:41532: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
country_id: 1814991
description:
Feb  6 15:35:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 15:35:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
country_id: 1814991
description:
2025-02-06 15:35:10 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:53625: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 15:35:22 ait sshd[1258702]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
country_id: 1210997
description:
Feb  6 15:35:22 ait sshd[1258702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 15:35:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 15:35:50 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:34688: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.149.185
country_id: 1814991
description:
Feb  6 15:36:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.149.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.149.185
country_id: 1814991
description:
2025-02-06 15:36:03 dovecot_plain authenticator failed for ([120.237.149.185]) [120.237.149.185]:1570: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
country_id: 3469034
description:
Feb  6 15:37:18 ait sshd[1259471]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.162.79
country_id: 99237
description:
[2025-02-06 15:36:40 +0100] info [webmaild] 151.236.162.79 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-06 15:36:42 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:32475: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.176.159.140
country_id: 1269750
description:
Feb  6 15:36:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.176.159.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
country_id: 1814991
description:
Feb  6 15:37:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
country_id: 2542007
description:
Feb  6 15:37:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.186.83.209
country_id: 831053
description:
[2025-02-06 15:37:15 +0100] info [webmaild] 185.186.83.209 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
country_id: 6252001
description:
2025-02-06 15:36:49 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:41572: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.159.140
country_id: 1269750
description:
2025-02-06 15:36:54 dovecot_plain authenticator failed for (abts-north-dynamic-140.159.176.122.airtelbroadband.in) [122.176.159.140]:51749: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-06 15:37:00 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:56484: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 206.189.47.166
country_id: 1880251
description:
Feb  6 15:37:09 ait sshd[1259429]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=206.189.47.166  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.62.67.73
country_id: 2510769
description:
2025-02-06 15:36:30 dovecot_plain authenticator failed for ([85.62.67.73]) [85.62.67.73]:58692: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
country_id: 3585968
description:
2025-02-06 15:36:32 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:42095: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.120.192.105
country_id: 732800
description:
Feb  6 15:36:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.120.192.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
country_id: 1814991
description:
Feb  6 15:36:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
country_id: 1814991
description:
2025-02-06 15:37:06 dovecot_plain authenticator failed for ([218.4.214.115]) [218.4.214.115]:34840: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.159.239.202
country_id: 1269750
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:15-37.103.159.239.202


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
country_id: 6252001
description:
Feb  6 15:36:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
country_id: 3658394
description:
Feb  6 15:37:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
country_id: 2542007
description:
2025-02-06 15:37:15 dovecot_plain authenticator failed for (ovelly) [102.53.15.17]:34920: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.154.94.85
country_id: 1819730
description:
Feb  6 15:37:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.154.94.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.40.85
country_id: 1269750
description:
Feb  6 15:37:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.40.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-06 15:36:42 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:35972: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
country_id: 2661886
description:
Feb  6 15:36:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
country_id: 1835841
description:
Feb  6 15:36:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.134
country_id: 1835841
description:
2025-02-06 15:37:04 dovecot_plain authenticator failed for ([211.109.93.134]) [211.109.93.134]:49166: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.189.47.166
country_id: 1880251
description:
Feb  6 15:37:08 ait sshd[1259429]: pam_imunify(sshd:auth): [IM360_RBL] The IP 206.189.47.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.75
country_id: 1269750
description:
Feb  6 15:36:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
country_id: 3469034
description:
Feb  6 15:37:18 ait sshd[1259471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 15:37:19 ait sshd[1259477]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
country_id: 1814991
description:
2025-02-06 15:36:53 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:57436: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
country_id: 2661886
description:
2025-02-06 15:36:53 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:50178: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.62.67.73
country_id: 2510769
description:
Feb  6 15:36:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.62.67.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
country_id: 3585968
description:
Feb  6 15:36:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  6 15:36:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
country_id: 1814991
description:
Feb  6 15:36:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.120.192.105
country_id: 732800
description:
2025-02-06 15:36:47 dovecot_plain authenticator failed for (109-120-192-105.ip.btc-net.bg) [109.120.192.105]:46682: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.75
country_id: 1269750
description:
2025-02-06 15:36:49 dovecot_plain authenticator failed for (nsg-corporate-75.230.187.122.airtel.in) [122.187.230.75]:49311: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.134
country_id: 1835841
description:
Feb  6 15:37:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
country_id: 1819730
description:
2025-02-06 15:37:03 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:33908: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-02-06 15:37:15 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:46750: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
country_id: 2750405
description:
Feb  6 15:37:19 ait sshd[1259477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.40.85
country_id: 1269750
description:
2025-02-06 15:37:19 dovecot_plain authenticator failed for ([103.177.40.85]) [103.177.40.85]:55205: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
country_id: 1835841
description:
Feb  6 15:37:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-38.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.136
country_id: 2017370
description:
Feb  6 15:38:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.202.61.155
country_id: 2017370
description:
Feb  6 15:37:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.202.61.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2025-02-06 15:37:46 dovecot_login authenticator failed for ([220.122.115.9]) [220.122.115.9]:34492: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.214.153.51
country_id: 6251999
description:
Feb  6 15:37:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.214.153.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.232.19.79
country_id: 2750405
description:
Feb  6 15:37:59 ait sshd[1259683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.232.19.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
country_id: 1168579
description:
2025-02-06 15:38:01 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:46129: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
country_id: 1168579
description:
Feb  6 15:37:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.232.19.79
country_id: 2750405
description:
Feb  6 15:37:59 ait sshd[1259683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.232.19.79


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.136
country_id: 2017370
description:
2025-02-06 15:38:19 dovecot_plain authenticator failed for ([178.178.194.136]) [178.178.194.136]:50538: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.202.61.155
country_id: 2017370
description:
2025-02-06 15:37:40 dovecot_plain authenticator failed for 155-61-202-109.kamensktel.ru [109.202.61.155]:44559: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.153.51
country_id: 6251999
description:
2025-02-06 15:38:00 dovecot_login authenticator failed for (ADMIN) [181.214.153.51]:37522: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
country_id: 1814991
description:
Feb  6 15:38:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
country_id: 1814991
description:
2025-02-06 15:38:12 dovecot_login authenticator failed for ([36.134.78.162]) [36.134.78.162]:48921: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
country_id: 2017370
description:
Feb  6 15:39:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
country_id: 2017370
description:
2025-02-06 15:39:03 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:52538: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
country_id: 3469034
description:
2025-02-06 15:39:05 dovecot_plain authenticator failed for ([181.233.93.3]) [181.233.93.66]:60502: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
country_id: 1814991
description:
Feb  6 15:38:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
country_id: 2661886
description:
Feb  6 15:38:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
country_id: 2661886
description:
Feb  6 15:38:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
country_id: 2963597
description:
Feb  6 15:38:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
country_id: 2661886
description:
2025-02-06 15:38:44 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:37488: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-06 15:38:50 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:48340: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 15:38:58 ait sshd[1260115]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.214.214


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
country_id: 1814991
description:
2025-02-06 15:38:30 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:48764: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.224.123.153
country_id: 6252001
description:
2025-02-06 15:39:15 dovecot_plain authenticator failed for ([24.224.123.153]) [24.224.123.153]:48986: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
country_id: 1210997
description:
2025-02-06 15:38:52 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:47642: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.200.20.12
country_id: 1562822
description:
Feb  6 15:39:03 ait sshd[1260339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.200.20.12


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.182.89.19
country_id: 1814991
description:
Feb  6 15:39:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.182.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  6 15:38:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
country_id: 1210997
description:
Feb  6 15:38:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.210.107.22
country_id: 3017382
description:
Feb  6 15:39:01 ait sshd[1260286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.107.22


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.210.107.22
country_id: 3017382
description:
Feb  6 15:39:01 ait sshd[1260286]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.210.107.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.66
country_id: 3469034
description:
Feb  6 15:39:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Feb  6 15:39:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.182.89.19
country_id: 1814991
description:
2025-02-06 15:39:21 dovecot_plain authenticator failed for ([123.182.89.19]) [123.182.89.19]:57179: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-02-06 15:38:44 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:54231: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.120.115.214
country_id: 1210997
description:
[2025-02-06 15:38:42 +0100] info [webmaild] 45.120.115.214 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.22.214.214
country_id: 1269750
description:
Feb  6 15:38:58 ait sshd[1260115]: pam_imunify(sshd:auth): [IM360_RBL] The IP 165.22.214.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.200.20.12
country_id: 1562822
description:
Feb  6 15:39:03 ait sshd[1260339]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.200.20.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-02-06 15:39:24 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:38121: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Feb  6 15:38:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2025-02-06 15:38:40 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:43486: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-06 15:39:14 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:42552: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
country_id: 1814991
description:
Feb  6 15:39:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2025-02-06 15:38:34 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:44510: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.224.123.153
country_id: 6252001
description:
Feb  6 15:39:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.224.123.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2025-02-06 15:39:23 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:45325: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
country_id: 2017370
description:
Feb  6 15:39:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.62.213.212
country_id: 2464461
description:
[2025-02-06 15:39:37 +0100] info [webmaild] 41.62.213.212 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
country_id: 1835841
description:
Feb  6 15:39:40 ait sshd[1260543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
country_id: 2017370
description:
Feb  6 15:39:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 15:40:17 ait sshd[1260982]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
country_id: 3996063
description:
Feb  6 15:40:17 ait sshd[1260982]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
country_id: 1819730
description:
2025-02-06 15:39:32 dovecot_plain authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:13851: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
country_id: 2017370
description:
2025-02-06 15:39:36 dovecot_plain authenticator failed for (anted) [89.23.210.188]:36163: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
country_id: 1835841
description:
Feb  6 15:39:40 ait sshd[1260543]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  6 15:40:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
country_id: 1819730
description:
Feb  6 15:39:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-02-06 15:40:02 dovecot_plain authenticator failed for (isial) [64.72.74.162]:48195: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.240.49.222
country_id: 6252001
description:
Feb  6 15:40:35 ait sshd[1261274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.240.49.222  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 15:40:50 ait sshd[1261320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
country_id: 1819730
description:
Feb  6 15:40:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.240.49.222
country_id: 6252001
description:
Feb  6 15:40:35 ait sshd[1261274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.240.49.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
country_id: 1819730
description:
2025-02-06 15:40:53 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:27542: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 15:40:57 ait sshd[1261338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.63.225  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
country_id: 3175395
description:
2025-02-06 15:41:01 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:32779: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.99.125.37
country_id: 3469034
description:
[2025-02-06 15:40:46 +0100] info [webmaild] 177.99.125.37 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.63.225
country_id: 1880251
description:
Feb  6 15:40:57 ait sshd[1261338]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.63.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 15:40:58 ait sshd[1261369]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.87.187.71 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.87.187.71
country_id: 2017370
description:
Feb  6 15:40:58 ait sshd[1261369]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.87.187.71


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
country_id: 1861060
description:
2025-02-06 15:41:13 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:43596: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
country_id: 6251999
description:
Feb  6 15:40:27 ait sshd[1261070]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
country_id: 6251999
description:
Feb  6 15:40:27 ait sshd[1261070]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
country_id: 1269750
description:
Feb  6 15:40:50 ait sshd[1261320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
country_id: 3175395
description:
Feb  6 15:40:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
country_id: 1861060
description:
Feb  6 15:41:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.100.61.75
country_id: 3469034
description:
[2025-02-06 15:41:37 +0100] info [webmaild] 200.100.61.75 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-02-06 15:41:38 dovecot_plain authenticator failed for (turan) [64.72.74.162]:59152: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
country_id: 1814991
description:
Feb  6 15:42:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
country_id: 1814991
description:
2025-02-06 15:42:24 dovecot_login authenticator failed for ([116.114.84.234]) [116.114.84.234]:37548: 535 Incorrect authentication data (set_id=visa@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.163.57.10
country_id: 1643084
description:
Feb  6 15:41:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.163.57.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  6 15:41:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
country_id: 1643084
description:
2025-02-06 15:41:37 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:48348: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.113.61.126
country_id: 298795
description:
Feb  6 15:41:55 ait sshd[1261740]: pam_imunify(sshd:auth): [IM360_RBL] The IP 93.113.61.126 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 93.113.61.126
country_id: 298795
description:
Feb  6 15:41:55 ait sshd[1261740]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=93.113.61.126  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 15:43:16 ait sshd[1262466]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
country_id: 2750405
description:
Feb  6 15:43:16 ait sshd[1262466]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
country_id: 1820814
description:
2025-02-06 15:42:34 dovecot_login authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:52740: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.123.220.10
country_id: 3996063
description:
Feb  6 15:42:36 ait sshd[1262196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.123.220.10  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 15:42:50 ait sshd[1262260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  6 15:42:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
country_id: 2661886
description:
2025-02-06 15:43:23 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:51120: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.21.245
country_id: 1880251
description:
47.128.21.245 - - [06/Feb/2025:15:43:01 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15076952 HTTP/2.0" 302 0 oum.ait-edu.us.ait-edu.us "https://oum.ait-edu.us.ait-edu.us/wp-blog-header.php" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.21.245


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.148.41
country_id: 1819730
description:
Feb  6 15:42:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.148.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
country_id: 1820814
description:
Feb  6 15:42:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 15:42:45 ait sshd[1262246]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
country_id: 1562822
description:
Feb  6 15:42:45 ait sshd[1262246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.250.39
country_id: 3625428
description:
[2025-02-06 15:43:04 +0100] info [webmaild] 190.97.250.39 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
country_id: 1819730
description:
Feb  6 15:42:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
country_id: 2661886
description:
Feb  6 15:43:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.123.220.10
country_id: 3996063
description:
Feb  6 15:42:36 ait sshd[1262196]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.123.220.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
country_id: 1819730
description:
2025-02-06 15:42:48 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:49279: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.148.41
country_id: 1819730
description:
2025-02-06 15:42:36 dovecot_login authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:55845: 535 Incorrect authentication data (set_id=visa)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
country_id: 6252001
description:
Feb  6 15:42:50 ait sshd[1262260]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.188.103.179
country_id: 6252001
description:
2025-02-06 15:44:15 dovecot_login authenticator failed for (tagsdev.click) [199.188.103.179]:46074: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
country_id: 1814991
description:
Feb  6 15:43:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
country_id: 1814991
description:
2025-02-06 15:43:41 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:6169: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.34.118.118
country_id: 357994
description:
[2025-02-06 15:43:44 +0100] info [webmaild] 41.34.118.118 - team@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-43.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
country_id: 1835841
description:
Feb  6 15:44:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
country_id: 1835841
description:
2025-02-06 15:44:12 dovecot_login authenticator failed for ([222.119.124.66]) [222.119.124.66]:55738: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.103.179
country_id: 6252001
description:
Feb  6 15:44:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.188.103.179 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:15-43.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
country_id: 1814991
description:
Feb  6 15:44:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
country_id: 1814991
description:
2025-02-06 15:44:27 dovecot_login authenticator failed for ([121.11.160.60]) [121.11.160.60]:58721: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
country_id: 1880251
description:
2025-02-06 15:44:30 dovecot_login authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:4126: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.230.228.62
country_id: 1512440
description:
[2025-02-06 15:45:05 +0100] info [webmaild] 94.230.228.62 - team@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Feb  6 15:45:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-06 15:45:08 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:41174: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.112
country_id: 1880251
description:
Feb  6 15:44:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
country_id: 6252001
description:
Feb  6 15:44:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
country_id: 6252001
description:
2025-02-06 15:44:34 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:35075: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 15:45:42 ait sshd[1263602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.41.42.20
country_id: 3625428
description:
[2025-02-06 15:45:58 +0100] info [webmaild] 38.41.42.20 - team@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 15:45:34 ait sshd[1263578]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  6 15:45:42 ait sshd[1263599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.168.58.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.168.58.245
country_id: 1562822
description:
Feb  6 15:45:42 ait sshd[1263599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.168.58.245


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
country_id: 614540
description:
Feb  6 15:45:42 ait sshd[1263602]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
country_id: 1835841
description:
Feb  6 15:45:34 ait sshd[1263578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.72.242.209
country_id: 6252001
description:
Feb  6 15:47:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.72.242.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.43.4
country_id: 1814991
description:
Feb  6 15:46:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.43.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 15:46:30 ait sshd[1263876]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.240.121.228  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
country_id: 1835841
description:
Feb  6 15:46:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
country_id: 1835841
description:
2025-02-06 15:46:58 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:43966: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
country_id: 1835841
description:
Feb  6 15:47:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
country_id: 1880251
description:
Feb  6 15:47:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
country_id: 1835841
description:
2025-02-06 15:47:11 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:45906: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.240.121.228
country_id: 1819730
description:
Feb  6 15:46:30 ait sshd[1263876]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.240.121.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.72.242.209
country_id: 6252001
description:
2025-02-06 15:47:18 dovecot_plain authenticator failed for ([206.72.242.209]) [206.72.242.209]:43086: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.40.123
country_id: 2017370
description:
Feb  6 15:46:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.40.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
country_id: 1835841
description:
Feb  6 15:47:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
country_id: 6252001
description:
Feb  6 15:47:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-02-06 15:47:13 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:36201: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.43.4
country_id: 1814991
description:
2025-02-06 15:46:53 dovecot_plain authenticator failed for ([222.87.43.4]) [222.87.43.4]:38327: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.74.254
country_id: 1512440
description:
[2025-02-06 15:47:03 +0100] info [webmaild] 213.230.74.254 - team@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
country_id: 1835841
description:
2025-02-06 15:47:03 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:55118: 535 Incorrect authentication data (set_id=iric@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
country_id: 6252001
description:
2025-02-06 15:47:12 dovecot_login authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:34870: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
country_id: 2017370
description:
2025-02-06 15:46:53 dovecot_plain authenticator failed for (90.188.40.123.stbur.ru) [90.188.40.123]:55210: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
country_id: 1819730
description:
2025-02-06 15:47:48 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:63434: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.167.238
country_id: 6252001
description:
2025-02-06 15:47:52 dovecot_plain authenticator failed for ([65.76.167.238]) [65.76.167.238]:37608: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
country_id: 2017370
description:
2025-02-06 15:47:35 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:53540: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
country_id: 1819730
description:
Feb  6 15:47:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-06 15:47:40 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:39432: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
country_id: 1819730
description:
2025-02-06 15:47:46 dovecot_plain authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:54818: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.34.73.139
country_id: 1814991
description:
2025-02-06 15:47:47 dovecot_login authenticator failed for (139.73.34.171.adsl-pool.jx.chinaunicom.com) [171.34.73.139]:1085: 535 Incorrect authentication data (set_id=ads30b00480y)


