# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  7 03:19:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
country_id: 1835841
description:
2025-02-07 03:19:14 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:40448: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
country_id: 6252001
description:
2025-02-07 03:19:30 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:55000: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.171
country_id: 1668284
description:
Feb  7 03:19:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
country_id: 1835841
description:
2025-02-07 03:19:28 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:46241: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
country_id: 1814991
description:
Feb  7 03:19:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-07 03:19:32 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:39467: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.171
country_id: 1668284
description:
2025-02-07 03:19:34 dovecot_plain authenticator failed for 111-70-21-171.emome-ip.hinet.net [111.70.21.171]:54794: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
country_id: 1814991
description:
2025-02-07 03:19:09 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:47097: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.245.120
country_id: 1814991
description:
2025-02-07 03:19:09 dovecot_plain authenticator failed for (120.245.223.60.adsl-pool.sx.cn) [60.223.245.120]:40674: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.34
country_id: 1269750
description:
Feb  7 03:19:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.57.119.194
country_id: 1814991
description:
2025-02-07 03:19:21 dovecot_plain authenticator failed for ([113.57.119.194]) [113.57.119.194]:26688: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 03:19:24 ait sshd[1563529]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-02-07 03:19:17 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:41760: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 03:19:24 ait sshd[1563529]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.41.213
country_id: 2017370
description:
2025-02-07 03:19:17 dovecot_plain authenticator failed for ([78.36.41.213]) [78.36.41.213]:54254: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.124.54.6
country_id: 3469034
description:
2025-02-07 03:19:19 dovecot_plain authenticator failed for ([179.124.54.6]) [179.124.54.6]:39837: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.57.119.194
country_id: 1814991
description:
Feb  7 03:19:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.57.119.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
country_id: 1831722
description:
2025-02-07 03:19:28 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:44024: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.36.41.213
country_id: 2017370
description:
Feb  7 03:19:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.36.41.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.17.125.28
country_id: 1814991
description:
Feb  7 03:19:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.17.125.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
country_id: 2921044
description:
2025-02-07 03:19:27 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:59351: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
country_id: 3932488
description:
Feb  7 03:19:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
country_id: 1562822
description:
Feb  7 03:19:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.64
country_id: 3469034
description:
Feb  7 03:19:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
country_id: 1814991
description:
2025-02-07 03:19:26 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:38042: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.122.213
country_id: 3469034
description:
2025-02-07 03:19:37 dovecot_plain authenticator failed for (177-174-122-213.user.vivozap.com.br) [177.174.122.213]:32928: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
country_id: 1814991
description:
2025-02-07 03:19:13 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:38320: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
country_id: 1210997
description:
2025-02-07 03:19:16 dovecot_plain authenticator failed for ([103.65.227.72]) [114.130.181.74]:47490: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.64
country_id: 3469034
description:
2025-02-07 03:19:27 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.64]:59016: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
country_id: 1210997
description:
Feb  7 03:19:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
country_id: 2921044
description:
Feb  7 03:19:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
country_id: 1269750
description:
Feb  7 03:20:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
country_id: 1269750
description:
2025-02-07 03:20:28 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:60606: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.174
country_id: 1835841
description:
2025-02-07 03:20:31 dovecot_plain authenticator failed for ([218.149.228.174]) [218.149.228.174]:53552: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
country_id: 3469034
description:
Feb  7 03:20:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
country_id: 3508796
description:
2025-02-07 03:20:37 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:58544: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.192.131
country_id: 1835841
description:
2025-02-07 03:20:40 dovecot_plain authenticator failed for ([1.235.192.131]) [1.235.192.131]:47543: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
country_id: 1835841
description:
Feb  7 03:20:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/engine1/engine1/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.174
country_id: 1835841
description:
Feb  7 03:20:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
country_id: 3508796
description:
Feb  7 03:20:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.192.131
country_id: 1835841
description:
Feb  7 03:20:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.192.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
country_id: 3469034
description:
2025-02-07 03:20:54 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:41400: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
country_id: 1835841
description:
2025-02-07 03:21:01 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:33568: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
country_id: 1835841
description:
Feb  7 03:21:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.98
country_id: 6252001
description:
Feb  7 03:21:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-02-07 03:21:21 dovecot_plain authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:41422: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
country_id: 1814991
description:
2025-02-07 03:21:21 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:55092: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
country_id: 3469034
description:
Feb  7 03:21:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-02-07 03:21:37 dovecot_plain authenticator failed for ([181.233.140.250]) [181.233.140.250]:57806: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/js/engine1/js/js/engine1/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2025-02-07 03:21:11 dovecot_plain authenticator failed for ([220.95.14.102]) [220.95.14.102]:43576: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
country_id: 1814991
description:
Feb  7 03:21:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/js/js/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.239.1.134
country_id: 226074
description:
Feb  7 03:22:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.239.1.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.239.1.134
country_id: 226074
description:
2025-02-07 03:22:21 dovecot_plain authenticator failed for (134-1-239-197.r.airtel.ug) [197.239.1.134]:54978: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
country_id: 1835841
description:
Feb  7 03:22:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
country_id: 1835841
description:
2025-02-07 03:22:33 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:46702: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.122.202
country_id: 294640
description:
2025-02-07 03:23:58 dovecot_plain authenticator failed for ([2.55.122.202]) [2.55.122.202]:48546: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 03:24:02 ait sshd[1565320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 03:24:02 ait sshd[1565320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
country_id: 2328926
description:
2025-02-07 03:24:08 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:52762: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.122.202
country_id: 294640
description:
Feb  7 03:23:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.122.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
country_id: 2328926
description:
Feb  7 03:24:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/js/js/engine1/js/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-23.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.151.236
country_id: 3469034
description:
[2025-02-07 03:23:36 +0100] info [webmaild] 187.62.151.236 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-02-07 03:24:49 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:54236: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
country_id: 2635167
description:
Feb  7 03:24:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-07 03:24:20 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:45595: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-07 03:24:20 dovecot_plain authenticator failed for ([110.38.70.172]) [110.38.70.172]:55971: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
country_id: 1835841
description:
2025-02-07 03:24:22 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:36406: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.7.189
country_id: 1668284
description:
Feb  7 03:24:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.7.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
country_id: 3469034
description:
2025-02-07 03:24:34 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:46045: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.120.208.148
country_id: 2017370
description:
Feb  7 03:24:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.120.208.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.138
country_id: 3077311
description:
Feb  7 03:25:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.195.104
country_id: 1269750
description:
Feb  7 03:24:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.195.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  7 03:24:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
country_id: 1835841
description:
Feb  7 03:24:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.120.208.148
country_id: 2017370
description:
2025-02-07 03:24:41 dovecot_plain authenticator failed for ([146.120.208.148]) [146.120.208.148]:50790: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
country_id: 3469034
description:
Feb  7 03:24:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
country_id: 1835841
description:
2025-02-07 03:24:21 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:60969: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.230.176.152
country_id: 1269750
description:
Feb  7 03:24:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.230.176.152 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/engine1/engine1/engine1/js/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
country_id: 337996
description:
Feb  7 03:24:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.7.189
country_id: 1668284
description:
2025-02-07 03:24:36 dovecot_plain authenticator failed for 111-70-7-189.emome-ip.hinet.net [111.70.7.189]:57071: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.94.206.187
country_id: 3469034
description:
Feb  7 03:24:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.94.206.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
country_id: 3469034
description:
Feb  7 03:24:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.230.176.152
country_id: 1269750
description:
2025-02-07 03:24:35 dovecot_plain authenticator failed for ([103.230.176.152]) [103.230.176.152]:50556: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
country_id: 2017370
description:
2025-02-07 03:24:40 dovecot_plain authenticator failed for ([194.85.69.22]) [194.85.69.22]:57078: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.110.186
country_id: 1880251
description:
47.128.110.186 - - [07/Feb/2025:03:24:41 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19457519 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30&filter_course-language=79%2C121%2C183&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.110.186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
country_id: 6252001
description:
Feb  7 03:24:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 03:24:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
country_id: 1835841
description:
Feb  7 03:24:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.161
country_id: 1819730
description:
2025-02-07 03:24:20 dovecot_plain authenticator failed for ([121.202.154.161]) [121.202.154.161]:12600: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
country_id: 3469034
description:
2025-02-07 03:24:31 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:43922: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
country_id: 1168579
description:
Feb  7 03:24:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
country_id: 2635167
description:
2025-02-07 03:24:17 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:56074: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
country_id: 1835841
description:
Feb  7 03:24:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
country_id: 1835841
description:
2025-02-07 03:24:37 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:56546: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.74
country_id: 2077456
description:
2025-02-07 03:24:50 dovecot_plain authenticator failed for ([203.189.124.74]) [203.189.124.74]:50734: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.161
country_id: 1819730
description:
Feb  7 03:24:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.195.104
country_id: 1269750
description:
2025-02-07 03:24:19 dovecot_login authenticator failed for ([103.187.195.104]) [103.187.195.104]:60030: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
country_id: 3469034
description:
2025-02-07 03:24:20 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:36374: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2025-02-07 03:24:36 dovecot_login authenticator failed for ([196.189.126.10]) [196.189.126.10]:47618: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.85.69.22
country_id: 2017370
description:
Feb  7 03:24:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.85.69.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
country_id: 2077456
description:
Feb  7 03:24:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.138
country_id: 3077311
description:
2025-02-07 03:25:07 dovecot_login authenticator failed for (ADMIN) [212.102.39.138]:40028: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/engine1/js/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/engine1/js/engine1/js/data1/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.63.255
country_id: 99237
description:
[2025-02-07 03:26:45 +0100] info [webmaild] 37.238.63.255 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.46
country_id: 798544
description:
2025-02-07 03:26:55 dovecot_login authenticator failed for (ENNmn7LfP) [185.241.208.46]:62669: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.46
country_id: 798544
description:
Feb  7 03:26:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.46
country_id: 798544
description:
Feb  7 03:27:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.46
country_id: 798544
description:
2025-02-07 03:27:24 dovecot_login authenticator failed for (i3eCKUeLxG) [185.241.208.46]:62611: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/js/engine1/js/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
country_id: 1835841
description:
2025-02-07 03:28:15 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:59306: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.98
country_id: 6252001
description:
Feb  7 03:28:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2025-02-07 03:28:25 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:34140: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
country_id: 1835841
description:
Feb  7 03:28:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/engine1/engine1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.101.106.224
country_id: 2017370
description:
[2025-02-07 03:28:34 +0100] info [webmaild] 92.101.106.224 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/js/js/engine1/engine1/engine1/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.44.238
country_id: 1880251
description:
47.128.44.238 - - [07/Feb/2025:03:29:25 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18466465 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-category/mobile-apps/?filter_course-language=79&filtering=1&tutor-course-filter-category=144" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.44.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.255.96.29
country_id: 3175395
description:
2025-02-07 03:31:00 dovecot_login authenticator failed for (sole2-029.alida.it) [130.255.96.29]:5632: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 03:31:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
country_id: 6252001
description:
2025-02-07 03:30:48 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:35366: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.255.96.29
country_id: 3175395
description:
Feb  7 03:30:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.255.96.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/js/data1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  7 03:30:36 ait sshd[1568018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  7 03:30:36 ait sshd[1568018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
country_id: 6252001
description:
Feb  7 03:30:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.41.237
country_id: 1880251
description:
47.128.41.237 - - [07/Feb/2025:03:31:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14832809 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/999c50?panel=security" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.41.237


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/engine1/js/engine1/js/data1/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.214
country_id: 1814991
description:
Feb  7 03:31:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 03:31:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.214
country_id: 1814991
description:
2025-02-07 03:31:14 dovecot_plain authenticator failed for ([61.185.226.214]) [61.185.226.214]:45281: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
country_id: 6252001
description:
Feb  7 03:31:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
country_id: 6252001
description:
2025-02-07 03:31:25 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:46111: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 03:31:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
country_id: 1269750
description:
2025-02-07 03:32:43 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:55678: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/js/engine1/js/engine1/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
country_id: 1269750
description:
Feb  7 03:32:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
country_id: 2077456
description:
Feb  7 03:32:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
country_id: 2077456
description:
2025-02-07 03:32:57 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:56117: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
country_id: 3439705
description:
Feb  7 03:33:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
country_id: 102358
description:
Feb  7 03:33:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
country_id: 3439705
description:
2025-02-07 03:33:16 dovecot_login authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:35671: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
country_id: 1814991
description:
Feb  7 03:33:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-07 03:33:32 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:53168: 535 Incorrect authentication data (set_id=obiri)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/js/engine1/js/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
country_id: 1814991
description:
2025-02-07 03:33:35 dovecot_login authenticator failed for ([61.191.163.102]) [61.191.163.102]:59710: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
country_id: 102358
description:
2025-02-07 03:33:18 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:56476: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
country_id: 1835841
description:
Feb  7 03:33:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.165.200
country_id: 294640
description:
Feb  7 03:34:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.165.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
country_id: 294640
description:
2025-02-07 03:34:35 dovecot_plain authenticator failed for ([82.102.165.200]) [82.102.165.200]:38846: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/engine1/images/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
country_id: 1819730
description:
Feb  7 03:34:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
country_id: 1819730
description:
2025-02-07 03:34:23 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:42497: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 03:35:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
country_id: 1269750
description:
2025-02-07 03:36:05 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:18868: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/engine1/images/engine1/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 03:35:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 03:36:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
country_id: 1269750
description:
Feb  7 03:36:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.72.147.10
country_id: 1814991
description:
2025-02-07 03:36:36 dovecot_plain authenticator failed for ([180.166.163.26]) [222.72.147.10]:56868: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
country_id: 3932488
description:
2025-02-07 03:36:47 dovecot_plain authenticator failed for ([148.102.73.4]) [148.102.76.10]:44940: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.200.110
country_id: 1269750
description:
Feb  7 03:36:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.200.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.230.65.133
country_id: 1880251
domain: www.ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:03-36.52.230.65.133||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
country_id: 2017370
description:
Feb  7 03:36:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
country_id: 3932488
description:
Feb  7 03:36:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.164.208.189
country_id: 1814991
description:
Feb  7 03:37:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.164.208.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
country_id: 6252001
description:
Feb  7 03:36:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/js/data1/engine1/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.72.147.10
country_id: 1814991
description:
Feb  7 03:36:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.72.147.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
country_id: 6252001
description:
2025-02-07 03:36:14 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:41308: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
country_id: 2017370
description:
2025-02-07 03:36:42 dovecot_plain authenticator failed for (verodys) [81.211.77.58]:54948: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.200.110
country_id: 1269750
description:
2025-02-07 03:36:51 dovecot_plain authenticator failed for (103.163.200.110.dynamic-mytachyon.in) [103.163.200.110]:6387: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
country_id: 2017370
description:
Feb  7 03:37:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
country_id: 1814991
description:
2025-02-07 03:37:56 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:56557: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.164.208.189
country_id: 1814991
description:
2025-02-07 03:37:11 dovecot_plain authenticator failed for ([60.164.208.189]) [60.164.208.189]:38260: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
country_id: 2017370
description:
2025-02-07 03:37:42 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:43586: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
country_id: 1814991
description:
Feb  7 03:37:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/engine1/engine1/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/js/engine1/engine1/js/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-38.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.245.145.251
country_id: 1814991
description:
2025-02-07 03:38:34 dovecot_login authenticator failed for ([183.245.145.251]) [183.245.145.251]:59879: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
country_id: 3469034
description:
Feb  7 03:38:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.245.145.251
country_id: 1814991
description:
Feb  7 03:38:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.245.145.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
country_id: 3469034
description:
2025-02-07 03:38:51 dovecot_login authenticator failed for (200-205-133-193.customer.telesp.net.br) [187.8.163.70]:33828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
country_id: 1814991
description:
2025-02-07 03:39:41 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:52149: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/js/engine1/engine1/engine1/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
country_id: 1835841
description:
Feb  7 03:39:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-02-07 03:39:21 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:35458: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.137.140
country_id: 1814991
description:
2025-02-07 03:39:29 dovecot_plain authenticator failed for ([120.236.137.140]) [120.236.137.140]:43215: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.5
country_id: 1821275
description:
2025-02-07 03:39:34 dovecot_login authenticator failed for (ADMIN) [84.252.92.5]:51726: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
country_id: 1814991
description:
Feb  7 03:39:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.117.179
country_id: 1269750
description:
Feb  7 03:39:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.117.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 03:40:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.137.140
country_id: 1814991
description:
Feb  7 03:39:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.137.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 03:39:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.117.179
country_id: 1269750
description:
2025-02-07 03:39:43 dovecot_plain authenticator failed for (abts-mum-static-179.117.70.182.airtelbroadband.in) [182.70.117.179]:41150: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/engine1/js/engine1/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
country_id: 6251999
description:
Feb  7 03:40:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.72.99
country_id: 1269750
description:
Feb  7 03:40:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.72.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
country_id: 1269750
description:
2025-02-07 03:40:39 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:51720: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.87.230
country_id: 1814991
description:
Feb  7 03:40:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.87.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 03:40:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.77.118
country_id: 1814991
description:
Feb  7 03:40:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.77.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
country_id: 6251999
description:
2025-02-07 03:40:25 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:46751: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 03:40:27 dovecot_plain authenticator failed for ([27.223.100.91]) [27.223.100.90]:50638: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.77.118
country_id: 1814991
description:
2025-02-07 03:40:38 dovecot_plain authenticator failed for ([122.227.77.118]) [122.227.77.118]:43397: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.72.99
country_id: 1269750
description:
2025-02-07 03:40:40 dovecot_plain authenticator failed for ([152.52.72.99]) [152.52.72.99]:58848: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
country_id: 1269750
description:
Feb  7 03:40:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.87.230
country_id: 1814991
description:
2025-02-07 03:40:53 dovecot_plain authenticator failed for ([1.31.87.230]) [1.31.87.230]:54975: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
country_id: 1269750
description:
Feb  7 03:41:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
country_id: 1861060
description:
Feb  7 03:41:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  7 03:42:00 ait sshd[1572546]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 03:41:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
country_id: 6252001
description:
2025-02-07 03:41:41 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:59970: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
country_id: 1814991
description:
Feb  7 03:41:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
country_id: 3469034
description:
2025-02-07 03:41:45 dovecot_plain authenticator failed for ([177.159.150.111]) [177.159.150.111]:42790: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.220.235
country_id: 1814991
description:
Feb  7 03:41:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.220.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.129.201.81
country_id: 1210997
description:
Feb  7 03:41:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.129.201.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.155.146
country_id: 1835841
description:
2025-02-07 03:41:37 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:40112: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.243.62
country_id: 1814991
description:
Feb  7 03:41:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.243.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
country_id: 1814991
description:
2025-02-07 03:41:44 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:40006: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
country_id: 1814991
description:
Feb  7 03:41:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  7 03:41:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2025-02-07 03:41:53 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:35250: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 03:42:01 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:45862: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.145.160.119
country_id: 6252001
description:
Feb  7 03:41:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.145.160.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
country_id: 3469034
description:
Feb  7 03:41:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
country_id: 1269750
description:
2025-02-07 03:41:50 dovecot_plain authenticator failed for ([103.59.134.177]) [103.59.134.177]:5753: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
country_id: 1814991
description:
2025-02-07 03:41:23 dovecot_plain authenticator failed for ([210.22.130.22]) [58.246.241.234]:40868: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.167.217.147
country_id: 1835841
description:
2025-02-07 03:41:26 dovecot_plain authenticator failed for ([121.167.217.147]) [121.167.217.147]:39218: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  7 03:41:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.145.160.119
country_id: 6252001
description:
2025-02-07 03:41:38 dovecot_plain authenticator failed for 119.sub-166-145-160.myvzw.com [166.145.160.119]:50090: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.63.208
country_id: 1835841
description:
Feb  7 03:41:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.63.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.220.235
country_id: 1814991
description:
2025-02-07 03:41:48 dovecot_plain authenticator failed for ([118.122.220.235]) [118.122.220.235]:53838: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
country_id: 1835841
description:
Feb  7 03:41:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
country_id: 1861060
description:
2025-02-07 03:41:34 dovecot_plain authenticator failed for ([48.218.170.53]) [48.218.170.53]:41074: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-07 03:41:37 dovecot_plain authenticator failed for ([218.98.26.226]) [58.216.101.162]:58715: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
country_id: 6252001
description:
Feb  7 03:41:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
country_id: 1814991
description:
2025-02-07 03:41:41 dovecot_plain authenticator failed for ([221.13.67.132]) [221.13.67.132]:36363: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.243.62
country_id: 1814991
description:
2025-02-07 03:41:43 dovecot_plain authenticator failed for ([183.220.243.62]) [183.220.243.62]:40394: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.109
country_id: 1668284
description:
2025-02-07 03:41:44 dovecot_plain authenticator failed for 111-70-49-109.emome-ip.hinet.net [111.70.49.109]:35918: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
country_id: 1269750
description:
Feb  7 03:41:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-02-07 03:41:49 dovecot_plain authenticator failed for ([203.172.213.166]) [203.172.213.166]:49068: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
country_id: 2400553
description:
Feb  7 03:41:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
country_id: 3175395
description:
2025-02-07 03:41:20 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:48944: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
country_id: 2029969
description:
2025-02-07 03:41:21 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:48414: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-07 03:41:21 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:59144: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
country_id: 1814991
description:
2025-02-07 03:41:24 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:41707: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.218.48
country_id: 2017370
description:
2025-02-07 03:41:28 dovecot_plain authenticator failed for ([46.45.218.48]) [46.45.218.48]:50600: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-02-07 03:41:32 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:58222: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
country_id: 1269750
description:
2025-02-07 03:41:32 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:57278: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
country_id: 1814991
description:
2025-02-07 03:41:42 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:59268: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
country_id: 1814991
description:
Feb  7 03:41:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  7 03:41:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
country_id: 6252001
description:
Feb  7 03:41:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
country_id: 6252001
description:
2025-02-07 03:41:33 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:39972: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.155.146
country_id: 1835841
description:
Feb  7 03:41:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.86.2
country_id: 1814991
description:
2025-02-07 03:41:35 dovecot_plain authenticator failed for ([223.82.86.2]) [223.82.86.2]:46661: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
country_id: 1814991
description:
Feb  7 03:41:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
country_id: 1814991
description:
Feb  7 03:41:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.63.208
country_id: 1835841
description:
2025-02-07 03:41:44 dovecot_plain authenticator failed for ([119.207.63.208]) [119.207.63.208]:60399: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/engine1/engine1/engine1/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.172.170.49
country_id: 3996063
description:
2025-02-07 03:41:21 dovecot_plain authenticator failed for (201.172.170.49-clientes-izzi.mx) [201.172.170.49]:46320: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.174.136
country_id: 1814991
description:
Feb  7 03:41:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.174.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.129.201.81
country_id: 1210997
description:
2025-02-07 03:41:26 dovecot_plain authenticator failed for ([103.129.201.82]) [103.129.201.81]:44868: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
country_id: 3144096
description:
Feb  7 03:41:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 03:41:39 dovecot_plain authenticator failed for (nsg-static-173.125.76.182-airtel.com) [182.76.87.90]:44748: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  7 03:41:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
country_id: 1814991
description:
2025-02-07 03:41:45 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:55279: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.125.186
country_id: 1814991
description:
2025-02-07 03:41:57 dovecot_plain authenticator failed for ([36.32.223.199]) [36.33.125.186]:9855: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.241.61
country_id: 1269750
description:
Feb  7 03:42:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.241.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
country_id: 3175395
description:
Feb  7 03:41:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.214.122.105
country_id: 357994
description:
2025-02-07 03:41:24 dovecot_login authenticator failed for (ADMIN) [188.214.122.105]:54756: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.167.217.147
country_id: 1835841
description:
Feb  7 03:41:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.167.217.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
country_id: 1880251
description:
Feb  7 03:41:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Feb  7 03:41:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.82.86.2
country_id: 1814991
description:
Feb  7 03:41:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.82.86.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  7 03:42:00 ait sshd[1572546]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
country_id: 1835841
description:
2025-02-07 03:41:23 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:57020: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
country_id: 1269750
description:
Feb  7 03:41:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.218.48
country_id: 2017370
description:
Feb  7 03:41:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.218.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-02-07 03:41:27 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:34944: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
country_id: 1814991
description:
Feb  7 03:41:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
country_id: 6252001
description:
Feb  7 03:41:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.109
country_id: 1668284
description:
Feb  7 03:41:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
country_id: 1814991
description:
2025-02-07 03:41:50 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:59310: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 03:41:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2025-02-07 03:41:26 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:37667: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.80.68
country_id: 1835841
description:
Feb  7 03:41:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.80.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.41.218
country_id: 1814991
description:
Feb  7 03:41:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.41.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
country_id: 1605651
description:
Feb  7 03:41:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-07 03:41:51 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:60061: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.125.186
country_id: 1814991
description:
Feb  7 03:41:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.125.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.172.170.49
country_id: 3996063
description:
Feb  7 03:41:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.172.170.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
country_id: 2029969
description:
Feb  7 03:41:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-07 03:41:24 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:44045: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.80.68
country_id: 1835841
description:
2025-02-07 03:41:44 dovecot_plain authenticator failed for ([211.44.80.68]) [211.44.80.68]:48474: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
country_id: 1835841
description:
Feb  7 03:41:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
country_id: 1814991
description:
Feb  7 03:41:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
country_id: 3469034
description:
Feb  7 03:41:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.174.136
country_id: 1814991
description:
2025-02-07 03:41:27 dovecot_plain authenticator failed for ([117.159.174.136]) [117.159.174.136]:54564: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
country_id: 3469034
description:
2025-02-07 03:41:28 dovecot_plain authenticator failed for (45-225-194-121.ibiunet.com.br) [45.225.194.121]:35156: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
country_id: 6252001
description:
2025-02-07 03:41:43 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:34834: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-07 03:41:45 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:50201: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.41.218
country_id: 1814991
description:
2025-02-07 03:41:48 dovecot_plain authenticator failed for ([218.94.41.218]) [218.94.41.218]:41575: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
country_id: 1269750
description:
2025-02-07 03:42:10 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:46905: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.241.234
country_id: 1814991
description:
Feb  7 03:41:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.241.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
country_id: 1814991
description:
2025-02-07 03:41:23 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:34301: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
country_id: 3144096
description:
2025-02-07 03:41:34 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:32800: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2025-02-07 03:42:26 dovecot_plain authenticator failed for (plably) [102.53.15.18]:33841: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
country_id: 690791
description:
Feb  7 03:42:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
country_id: 690791
description:
2025-02-07 03:42:29 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (uncylus) [92.244.126.105]:52554: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/engine1/engine1/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
country_id: 2542007
description:
Feb  7 03:42:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.241.177
country_id: 2017370
description:
Feb  7 03:43:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.241.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
country_id: 3469034
description:
2025-02-07 03:43:49 dovecot_plain authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:34336: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
country_id: 1814991
description:
Feb  7 03:43:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 03:44:08 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:43582: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  7 03:43:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-07 03:43:34 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:34734: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
country_id: 1668284
description:
2025-02-07 03:43:36 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:55181: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
country_id: 1835841
description:
2025-02-07 03:44:06 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:41729: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
country_id: 1668284
description:
Feb  7 03:43:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
country_id: 2661886
description:
Feb  7 03:43:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
country_id: 1814991
description:
2025-02-07 03:43:50 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:56991: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
country_id: 3996063
description:
2025-02-07 03:43:58 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:63239: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/engine1/engine1/js/engine1/js/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-02-07 03:43:46 dovecot_plain authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:49130: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.98.177.66
country_id: 1814991
description:
Feb  7 03:43:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.98.177.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
country_id: 1835841
description:
Feb  7 03:44:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
country_id: 2661886
description:
2025-02-07 03:43:46 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:44852: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
country_id: 3469034
description:
Feb  7 03:43:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.177.66
country_id: 1814991
description:
2025-02-07 03:43:51 dovecot_plain authenticator failed for ([112.98.177.66]) [112.98.177.66]:50274: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
country_id: 1814991
description:
2025-02-07 03:43:59 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:55496: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.161.26
country_id: 1814991
description:
2025-02-07 03:44:05 dovecot_plain authenticator failed for ([223.95.161.26]) [223.95.161.26]:44562: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 03:44:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.241.177
country_id: 2017370
description:
2025-02-07 03:43:32 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:57900: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.95.13.185
country_id: 6252001
description:
Feb  7 03:43:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.95.13.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
country_id: 1814991
description:
Feb  7 03:43:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.161.26
country_id: 1814991
description:
Feb  7 03:44:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.161.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
country_id: 3996063
description:
Feb  7 03:43:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
country_id: 272103
description:
Feb  7 03:44:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
country_id: 1814991
description:
2025-02-07 03:44:18 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:34268: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.169.140
country_id: 6252001
description:
Feb  7 03:44:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.169.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
country_id: 272103
description:
2025-02-07 03:44:22 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:57575: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.19.27
country_id: 1880251
description:
47.128.19.27 - - [07/Feb/2025:03:45:00 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17759865 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?filter_course-category=106%2C30&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.19.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
country_id: 1814991
description:
Feb  7 03:44:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/js/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.169.140
country_id: 6252001
description:
2025-02-07 03:44:59 dovecot_plain authenticator failed for brt-pppoe-209-173-169-140.dsl.bright.net [209.173.169.140]:37739: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
country_id: 1814991
description:
2025-02-07 03:45:02 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:53568: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Feb  7 03:45:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2025-02-07 03:45:06 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:39090: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
country_id: 1814991
description:
Feb  7 03:45:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/js/js/engine1/engine1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
country_id: 6252001
description:
2025-02-07 03:45:12 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:42623: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
country_id: 290557
description:
Feb  7 03:45:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
country_id: 1835841
description:
2025-02-07 03:45:32 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:33198: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
country_id: 3895114
description:
Feb  7 03:45:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
country_id: 6252001
description:
Feb  7 03:45:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
country_id: 2635167
description:
2025-02-07 03:45:17 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:8207: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
country_id: 1835841
description:
Feb  7 03:45:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 03:45:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
country_id: 1835841
description:
Feb  7 03:45:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
country_id: 1835841
description:
2025-02-07 03:45:20 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:45241: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
country_id: 290557
description:
2025-02-07 03:45:21 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:46803: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
country_id: 3895114
description:
2025-02-07 03:45:37 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:39658: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.250.177.106
country_id: 2275384
description:
Feb  7 03:45:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.250.177.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
country_id: 2635167
description:
Feb  7 03:45:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.153.179
country_id: 3469034
description:
[2025-02-07 03:45:16 +0100] info [webmaild] 160.238.153.179 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.177.106
country_id: 2275384
description:
2025-02-07 03:45:16 dovecot_plain authenticator failed for ([196.250.177.106]) [196.250.177.106]:55109: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.72
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/engine1/js/engine1/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.188
country_id: 1814991
description:
Feb  7 03:46:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.188
country_id: 1814991
description:
2025-02-07 03:46:15 dovecot_login authenticator failed for ([27.40.100.188]) [27.40.100.188]:47549: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
country_id: 6252001
description:
Feb  7 03:46:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
country_id: 6252001
description:
2025-02-07 03:46:24 dovecot_login authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:43254: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.23.254
country_id: 3469034
description:
[2025-02-07 03:46:32 +0100] info [webmaild] 45.179.23.254 - info@aitsmartschool.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 03:46:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 03:47:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.141.99.48
country_id: 2017370
description:
[2025-02-07 03:48:25 +0100] info [webmaild] 178.141.99.48 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 03:48:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
country_id: 3469034
description:
Feb  7 03:49:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
country_id: 3469034
description:
2025-02-07 03:49:12 dovecot_plain authenticator failed for ([177.43.106.73]) [177.43.106.73]:51739: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.156.13.130
country_id: 3996063
description:
[2025-02-07 03:49:13 +0100] info [webmaild] 189.156.13.130 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
country_id: 2287781
description:
Feb  7 03:49:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
country_id: 2287781
description:
2025-02-07 03:49:21 dovecot_plain authenticator failed for ([38.230.100.252]) [38.230.100.252]:56608: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
country_id: 1880251
description:
Feb  7 03:50:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.151
country_id: 99237
description:
Feb  7 03:51:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
country_id: 6252001
description:
2025-02-07 03:51:06 dovecot_plain authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com [44.211.191.117]:46382: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
country_id: 798544
description:
2025-02-07 03:51:08 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:39194: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
country_id: 6252001
description:
Feb  7 03:51:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.59.157
country_id: 3277605
description:
2025-02-07 03:51:03 dovecot_plain authenticator failed for ([195.222.59.157]) [195.222.59.157]:44090: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
country_id: 1835841
description:
2025-02-07 03:51:07 dovecot_plain authenticator failed for ([175.203.245.102]) [175.203.245.102]:38698: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.115.173.11
country_id: 1269750
description:
2025-02-07 03:51:07 dovecot_plain authenticator failed for ([45.115.173.11]) [45.115.173.11]:36236: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
country_id: 2017370
description:
2025-02-07 03:51:05 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:54334: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
country_id: 6252001
description:
Feb  7 03:50:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.203
country_id: 2017370
description:
2025-02-07 03:50:37 dovecot_plain authenticator failed for ([178.178.194.203]) [178.178.194.203]:46500: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
country_id: 6252001
description:
2025-02-07 03:50:54 dovecot_plain authenticator failed for ([74.196.184.120]) [74.196.184.120]:39581: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
country_id: 1835841
description:
Feb  7 03:51:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.151
country_id: 99237
description:
2025-02-07 03:51:07 dovecot_plain authenticator failed for ([65.20.169.151]) [65.20.169.151]:55922: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.203
country_id: 2017370
description:
Feb  7 03:50:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
country_id: 1880251
description:
2025-02-07 03:50:41 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:60407: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
country_id: 2963597
description:
Feb  7 03:51:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
country_id: 798544
description:
Feb  7 03:51:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-02-07 03:50:33 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:38264: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
country_id: 2963597
description:
2025-02-07 03:51:04 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:59787: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.115.173.11
country_id: 1269750
description:
Feb  7 03:51:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.115.173.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
country_id: 1835841
description:
Feb  7 03:51:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
country_id: 1210997
description:
Feb  7 03:51:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
country_id: 6252001
description:
Feb  7 03:50:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.59.157
country_id: 3277605
description:
Feb  7 03:51:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.59.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
country_id: 2017370
description:
Feb  7 03:51:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.220.235
country_id: 1814991
description:
2025-02-07 03:51:33 dovecot_plain authenticator failed for ([118.122.220.235]) [118.122.220.235]:34928: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
country_id: 6252001
description:
Feb  7 03:51:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
country_id: 1814991
description:
2025-02-07 03:51:15 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:33150: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
country_id: 1831722
description:
2025-02-07 03:51:28 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:44972: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  7 03:51:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.31.47.232
country_id: 6252001
description:
2025-02-07 03:51:30 dovecot_plain authenticator failed for syn-065-031-047-232.res.spectrum.com [65.31.47.232]:55032: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.220.235
country_id: 1814991
description:
Feb  7 03:51:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.220.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
country_id: 1269750
description:
2025-02-07 03:51:19 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:50098: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.189
country_id: 1814991
description:
2025-02-07 03:51:20 dovecot_plain authenticator failed for ([27.40.100.189]) [27.40.100.189]:57140: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.139
country_id: 1835841
description:
2025-02-07 03:51:45 dovecot_plain authenticator failed for ([61.108.83.254]) [61.108.83.139]:45308: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
country_id: 1210997
description:
2025-02-07 03:51:09 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:34308: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.189
country_id: 1814991
description:
Feb  7 03:51:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.184.119.106
country_id: 1814991
description:
Feb  7 03:51:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.184.119.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
country_id: 1819730
description:
2025-02-07 03:51:17 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:52120: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.155.105
country_id: 1814991
description:
Feb  7 03:51:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.155.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
country_id: 1814991
description:
2025-02-07 03:51:28 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:9384: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.139
country_id: 1835841
description:
Feb  7 03:51:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.147.181
country_id: 1861060
description:
Feb  7 03:51:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.147.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
country_id: 1814991
description:
Feb  7 03:51:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2025-02-07 03:52:04 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:53951: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
country_id: 1814991
description:
Feb  7 03:51:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.155.105
country_id: 1814991
description:
2025-02-07 03:51:28 dovecot_plain authenticator failed for ([222.68.155.105]) [222.68.155.105]:52518: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.31.47.232
country_id: 6252001
description:
Feb  7 03:51:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.31.47.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
country_id: 6252001
description:
2025-02-07 03:51:52 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:48364: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.147.181
country_id: 1861060
description:
2025-02-07 03:51:12 dovecot_plain authenticator failed for p238181-obmd01.tokyo.ocn.ne.jp [153.141.147.181]:36631: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
country_id: 1835841
description:
2025-02-07 03:51:23 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:47540: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
country_id: 1835841
description:
Feb  7 03:52:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
country_id: 1835841
description:
2025-02-07 03:51:09 dovecot_plain authenticator failed for ([110.35.63.27]) [110.35.63.27]:54832: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.207.129.246
country_id: 614540
description:
Feb  7 03:51:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.207.129.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
country_id: 1562822
description:
2025-02-07 03:51:21 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:48108: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.207.129.246
country_id: 614540
description:
2025-02-07 03:51:23 dovecot_plain authenticator failed for ([185.207.129.246]) [185.207.129.246]:33846: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
country_id: 1831722
description:
Feb  7 03:51:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-07 03:51:30 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:46431: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
country_id: 1168579
description:
2025-02-07 03:51:14 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:60689: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
country_id: 1835841
description:
Feb  7 03:51:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
country_id: 1562822
description:
Feb  7 03:51:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.184.119.106
country_id: 1814991
description:
2025-02-07 03:51:19 dovecot_plain authenticator failed for ([117.184.119.106]) [117.184.119.106]:24930: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
country_id: 1819730
description:
Feb  7 03:51:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
country_id: 1819730
description:
2025-02-07 03:51:36 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:34555: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
country_id: 1819730
description:
Feb  7 03:51:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
country_id: 1269750
description:
Feb  7 03:51:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.28.237
country_id: 3175395
description:
Feb  7 03:52:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.28.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.54
country_id: 1733045
description:
2025-02-07 03:52:48 dovecot_plain authenticator failed for ([49.124.149.54]) [49.124.149.54]:37066: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 03:53:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
country_id: 6252001
description:
Feb  7 03:52:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
country_id: 3469034
description:
2025-02-07 03:52:36 dovecot_login authenticator failed for (200151009074.userdial.telemar.net.br) [200.151.9.74]:54549: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.28.237
country_id: 3175395
description:
2025-02-07 03:52:44 dovecot_plain authenticator failed for host-79-21-28-237.retail.telecomitalia.it [79.21.28.237]:43727: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.149.54
country_id: 1733045
description:
Feb  7 03:52:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.149.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
country_id: 1269750
description:
Feb  7 03:52:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
country_id: 1269750
description:
2025-02-07 03:52:50 dovecot_login authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:43132: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-07 03:52:29 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:34552: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
country_id: 3469034
description:
Feb  7 03:52:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
country_id: 1835841
description:
2025-02-07 03:53:48 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:49623: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.49.15
country_id: 2510769
description:
Feb  7 03:53:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.213.49.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.58
country_id: 1835841
description:
Feb  7 03:54:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.85.42.195
country_id: 1814991
description:
2025-02-07 03:53:22 dovecot_plain authenticator failed for ([1.85.42.195]) [1.85.42.195]:54587: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
country_id: 1835841
description:
2025-02-07 03:53:28 dovecot_plain authenticator failed for ([110.14.192.20]) [110.14.192.20]:44732: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
country_id: 1835841
description:
Feb  7 03:53:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.14.135
country_id: 1668284
description:
Feb  7 03:53:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.14.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.14.135
country_id: 1668284
description:
2025-02-07 03:53:47 dovecot_plain authenticator failed for 111-70-14-135.emome-ip.hinet.net [111.70.14.135]:37958: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
country_id: 1814991
description:
Feb  7 03:53:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
country_id: 2510769
description:
2025-02-07 03:53:57 dovecot_plain authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:52425: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-53.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.250.153.55
country_id: 3932488
description:
[2025-02-07 03:53:37 +0100] info [webmaild] 38.250.153.55 - info@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
country_id: 1835841
description:
Feb  7 03:53:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  7 03:53:45 ait sshd[1576430]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.85.42.195
country_id: 1814991
description:
Feb  7 03:53:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.85.42.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.86
country_id: 6252001
description:
Feb  7 03:53:45 ait sshd[1576430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.86


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
country_id: 6252001
description:
Feb  7 03:53:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
country_id: 1814991
description:
2025-02-07 03:54:00 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:53648: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
country_id: 1835841
description:
Feb  7 03:53:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
country_id: 1835841
description:
2025-02-07 03:53:42 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:54994: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
country_id: 6252001
description:
2025-02-07 03:53:51 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:48778: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
country_id: 1835841
description:
2025-02-07 03:54:43 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:45120: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
country_id: 1819730
description:
2025-02-07 03:54:53 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:55381: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.177.55
country_id: 6251999
description:
2025-02-07 03:54:21 dovecot_plain authenticator failed for ([209.141.177.55]) [209.141.177.55]:36317: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
country_id: 1835841
description:
Feb  7 03:54:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
country_id: 1880251
description:
2025-02-07 03:54:47 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:41389: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.58
country_id: 1835841
description:
2025-02-07 03:54:10 dovecot_plain authenticator failed for ([211.243.43.58]) [211.243.43.58]:57158: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.141.177.55
country_id: 6251999
description:
Feb  7 03:54:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.141.177.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
country_id: 1819730
description:
Feb  7 03:54:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
country_id: 1269750
description:
Feb  7 03:54:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
country_id: 1269750
description:
2025-02-07 03:54:57 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:40538: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
country_id: 3175395
description:
2025-02-07 03:54:37 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:57872: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
country_id: 1880251
description:
Feb  7 03:54:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
country_id: 3175395
description:
Feb  7 03:54:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
country_id: 6252001
description:
Feb  7 03:55:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
country_id: 3469034
description:
2025-02-07 03:55:38 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:33907: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
country_id: 1512440
description:
Feb  7 03:55:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-02-07 03:55:47 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:47992: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
country_id: 1835841
description:
2025-02-07 03:55:58 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:42246: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
country_id: 1562822
description:
Feb  7 03:56:02 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
country_id: 6252001
description:
2025-02-07 03:55:28 dovecot_plain authenticator failed for zdomainaccess.com [216.70.114.230]:44800: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
country_id: 3469034
description:
Feb  7 03:55:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
country_id: 1835841
description:
Feb  7 03:55:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
country_id: 1562822
description:
2025-02-07 03:56:04 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:57240: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.242.78
country_id: 1814991
description:
Feb  7 03:56:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.242.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
country_id: 1880251
description:
Feb  7 03:56:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Feb  7 03:57:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
country_id: 2750405
description:
2025-02-07 03:56:13 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:18292: 535 Incorrect authentication data (set_id=oudoc)


plugin: modsec
rule: 77141092
name: IM360 WAF: Suspicious access attempt to admin-ajax.php. No referrer header
abuser: 49.93.64.103
country_id: 1814991
domain: 136.243.145.84:80
description:
IM360 WAF: Suspicious access attempt to admin-ajax.php. No referrer header||WPU:||RSV:6.65||T:APACHE||MVN:REQUEST_HEADERS||MV:0||SC:/var/www/html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-02-07 03:56:34 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:48738: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2025-02-07 03:57:03 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:57484: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
country_id: 2750405
description:
Feb  7 03:56:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.242.78
country_id: 1814991
description:
2025-02-07 03:56:19 dovecot_plain authenticator failed for ([120.224.242.78]) [120.224.242.78]:44833: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
country_id: 1668284
description:
Feb  7 03:57:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
country_id: 1668284
description:
2025-02-07 03:57:15 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:35438: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.50.218.154
country_id: 6251999
description:
2025-02-07 03:58:12 dovecot_login authenticator failed for (ADMIN) [149.50.218.154]:41058: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 03:58:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 03:58:41 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au ([60.242.84.9]) [110.175.220.250]:45859: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 57.128.47.31
country_id: 3017382
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-58.57.128.47.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
country_id: 1814991
description:
Feb  7 03:58:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-07 03:58:55 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:39366: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
country_id: 1814991
description:
2025-02-07 03:58:54 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:48046: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  7 03:58:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
country_id: 174982
description:
Feb  7 03:59:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
country_id: 1814991
description:
2025-02-07 03:59:44 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:32923: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.252.92.5
country_id: 1821275
description:
2025-02-07 03:59:13 dovecot_login authenticator failed for (ADMIN) [84.252.92.5]:34716: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
country_id: 2750405
description:
2025-02-07 03:59:27 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:60410: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 03:59:31 ait sshd[1578361]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
country_id: 174982
description:
2025-02-07 03:59:37 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:48790: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
country_id: 2750405
description:
Feb  7 03:59:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
country_id: 2750405
description:
Feb  7 03:59:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.186.142
country_id: 3469034
description:
Feb  7 03:59:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.186.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
country_id: 1814991
description:
Feb  7 03:59:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
country_id: 2750405
description:
2025-02-07 03:59:14 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:36729: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.186.142
country_id: 3469034
description:
2025-02-07 03:59:31 dovecot_plain authenticator failed for ([201.88.186.142]) [201.88.186.142]:39501: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 03:59:31 ait sshd[1578361]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
country_id: 1733045
description:
2025-02-07 04:00:30 dovecot_plain authenticator failed for ([175.136.192.106]) [175.136.192.106]:58372: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Feb  7 04:00:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-07 04:00:20 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:34832: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
country_id: 1733045
description:
Feb  7 04:00:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
country_id: 1835841
description:
2025-02-07 04:01:34 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:60320: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.212.11.29
country_id: 3469034
description:
[2025-02-07 04:01:39 +0100] info [webmaild] 179.212.11.29 - info@jaster.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
country_id: 2077456
description:
Feb  7 04:01:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
country_id: 2077456
description:
2025-02-07 04:01:41 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:60632: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
country_id: 690791
description:
Feb  7 04:01:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-02-07 04:01:20 dovecot_login authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:34259: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.107.108.78
country_id: 1814991
description:
2025-02-07 04:01:26 dovecot_plain authenticator failed for ([180.107.108.78]) [180.107.108.78]:38690: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
country_id: 1835841
description:
Feb  7 04:01:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.154.41.253
country_id: 6252001
description:
Feb  7 04:02:16 ait sshd[1579629]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.154.41.253


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.152
country_id: 2921044
domain: elibrary.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:adamsf761@gmail.com||WPU:adamsf761@gmail.com||RSV:6.65||T:APACHE||MV:04-02.204.10.194.152


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.104.103.146
country_id: 1814991
description:
Feb  7 04:02:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.104.103.146 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 189.126.111.130
country_id: 3469034
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-03.189.126.111.130


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.185
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/engine1/engine1/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.171.207.185
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-02.20.171.207.185||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.154.41.253
country_id: 6252001
description:
Feb  7 04:02:16 ait sshd[1579629]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.154.41.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
country_id: 1269750
description:
2025-02-07 04:03:24 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:37390: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
country_id: 1269750
description:
2025-02-07 04:03:29 dovecot_login authenticator failed for ([115.245.172.214]) [115.245.172.214]:55180: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.154.41.253
country_id: 6252001
description:
Feb  7 04:03:35 ait sshd[1580168]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.154.41.253


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
country_id: 2017370
description:
Feb  7 04:03:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
country_id: 6252001
description:
2025-02-07 04:03:16 dovecot_login authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:45181: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
country_id: 1269750
description:
Feb  7 04:03:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.154.41.253
country_id: 6252001
description:
Feb  7 04:03:35 ait sshd[1580168]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.154.41.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
country_id: 1814991
description:
Feb  7 04:04:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
country_id: 1814991
description:
2025-02-07 04:04:03 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:55158: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
country_id: 2017370
description:
2025-02-07 04:03:11 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:52260: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
country_id: 6252001
description:
Feb  7 04:03:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
country_id: 1269750
description:
Feb  7 04:03:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
country_id: 6252001
description:
Feb  7 04:04:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.52
country_id: 2017370
description:
Feb  7 04:05:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.171
country_id: 1668284
description:
Feb  7 04:04:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
country_id: 3017382
description:
Feb  7 04:04:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  7 04:04:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
country_id: 1814991
description:
2025-02-07 04:04:46 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:36861: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.52
country_id: 2017370
description:
2025-02-07 04:05:02 dovecot_login authenticator failed for ([178.178.222.52]) [178.178.222.52]:53544: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
country_id: 3017382
description:
2025-02-07 04:04:28 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:42514: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-07 04:04:40 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:3042: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 68.154.41.253
country_id: 6252001
description:
Feb  7 04:04:49 ait sshd[1580447]: Failed password for invalid user gyli from 68.154.41.253 port 58152 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
country_id: 6252001
description:
2025-02-07 04:04:56 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:63678: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.89.146
country_id: 1814991
description:
Feb  7 04:04:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.89.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.171
country_id: 1668284
description:
2025-02-07 04:04:16 dovecot_plain authenticator failed for 111-70-21-171.emome-ip.hinet.net [111.70.21.171]:48878: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.154.41.253
country_id: 6252001
description:
Feb  7 04:04:48 ait sshd[1580447]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.154.41.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.89.146
country_id: 1814991
description:
2025-02-07 04:04:19 dovecot_plain authenticator failed for ([58.18.89.146]) [58.18.89.146]:37843: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.154.41.253
country_id: 6252001
description:
Feb  7 04:04:48 ait sshd[1580447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.154.41.253


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
country_id: 2017370
description:
2025-02-07 04:05:58 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:38952: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
country_id: 1835841
description:
Feb  7 04:06:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
country_id: 1835841
description:
2025-02-07 04:06:06 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:35110: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.109.127.195
country_id: 1819730
description:
Feb  7 04:05:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.109.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.109.127.195
country_id: 1819730
description:
2025-02-07 04:05:19 dovecot_login authenticator failed for ([39.109.127.195]) [39.109.127.195]:58298: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
country_id: 2017370
description:
Feb  7 04:05:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.9.38.174
country_id: 6251999
description:
2025-02-07 04:06:14 dovecot_login authenticator failed for ([76.9.38.174]) [76.9.38.174]:37788: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
country_id: 1814991
description:
2025-02-07 04:06:23 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:48422: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
country_id: 1269750
description:
2025-02-07 04:06:58 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:34144: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.9.38.174
country_id: 6251999
description:
Feb  7 04:06:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.9.38.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
country_id: 337996
description:
Feb  7 04:06:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2025-02-07 04:06:16 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:47658: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
country_id: 1814991
description:
Feb  7 04:06:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
country_id: 1269750
description:
Feb  7 04:06:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
country_id: 1880251
description:
Feb  7 04:07:08 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.52.106.152
country_id: 2017370
description:
Feb  7 04:06:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.52.106.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.52.106.152
country_id: 2017370
description:
2025-02-07 04:06:24 dovecot_login authenticator failed for ([95.52.106.152]) [95.52.106.152]:44135: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 04:07:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2025-02-07 04:07:10 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:35938: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.140.89.82
country_id: 1835841
description:
Feb  7 04:07:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.140.89.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
country_id: 1814991
description:
2025-02-07 04:07:30 dovecot_plain authenticator failed for ([1.180.97.138]) [1.180.97.138]:42593: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
country_id: 2017370
description:
Feb  7 04:08:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
country_id: 2017370
description:
2025-02-07 04:08:09 dovecot_plain authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:44795: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
country_id: 1835841
description:
2025-02-07 04:07:16 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:37326: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-02-07 04:07:16 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:55945: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  7 04:07:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-07 04:07:30 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:48424: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 04:08:00 dovecot_plain authenticator failed for ([27.223.100.90]) [27.223.100.90]:53324: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.97.138
country_id: 1814991
description:
Feb  7 04:07:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
country_id: 1814991
description:
Feb  7 04:07:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
country_id: 1819730
description:
Feb  7 04:07:14 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2025-02-07 04:08:20 dovecot_plain authenticator failed for (watter) [64.72.74.162]:56502: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-08.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Feb  7 04:08:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
country_id: 6252001
description:
Feb  7 04:08:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-02-07 04:08:52 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:36510: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
country_id: 1269750
description:
Feb  7 04:09:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
country_id: 1269750
description:
2025-02-07 04:09:08 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:49161: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
country_id: 1814991
description:
Feb  7 04:09:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
country_id: 1814991
description:
2025-02-07 04:09:13 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:56025: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
country_id: 1814991
description:
Feb  7 04:09:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
country_id: 1814991
description:
2025-02-07 04:09:20 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:54708: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
country_id: 2750405
description:
Feb  7 04:09:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
country_id: 2750405
description:
2025-02-07 04:09:29 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:53715: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
country_id: 1835841
description:
Feb  7 04:09:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
country_id: 1835841
description:
2025-02-07 04:09:39 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:55696: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-07 04:10:12 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:35541: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
country_id: 1835841
description:
2025-02-07 04:10:46 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:48819: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
country_id: 3932488
description:
2025-02-07 04:10:48 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:59356: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.59.90.121
country_id: 2661886
description:
2025-02-07 04:11:07 dovecot_login authenticator failed for h-46-59-90-121.a463.priv.bahnhof.se [46.59.90.121]:38113: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
country_id: 1269750
description:
2025-02-07 04:11:09 dovecot_login authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:50194: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  7 04:10:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.171.207.185
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-10.20.171.207.185||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.34.46.13
country_id: 3469034
description:
[2025-02-07 04:10:35 +0100] info [webmaild] 187.34.46.13 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.59.90.121
country_id: 2661886
description:
Feb  7 04:11:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.59.90.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
country_id: 1269750
description:
Feb  7 04:11:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.185
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/images/data1/data1/js/js/engine1/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
country_id: 614540
description:
2025-02-07 04:10:35 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:60395: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
country_id: 1819730
description:
2025-02-07 04:10:54 dovecot_login authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:19346: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
country_id: 614540
description:
Feb  7 04:10:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
country_id: 1835841
description:
Feb  7 04:10:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
country_id: 3932488
description:
Feb  7 04:10:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
country_id: 1819730
description:
Feb  7 04:10:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
country_id: 1562822
description:
2025-02-07 04:11:49 dovecot_login authenticator failed for ([27.72.103.74]) [27.72.103.74]:55403: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
country_id: 1562822
description:
Feb  7 04:11:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
country_id: 1814991
description:
2025-02-07 04:11:12 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:52806: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
country_id: 6252001
description:
2025-02-07 04:11:20 dovecot_login authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:45316: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
country_id: 1819730
description:
2025-02-07 04:11:59 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:25957: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.171.207.185
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-11.20.171.207.185||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.248.211.38
country_id: 1814991
description:
Feb  7 04:11:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.248.211.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.248.211.38
country_id: 1814991
description:
2025-02-07 04:11:36 dovecot_plain authenticator failed for ([183.71.251.66]) [113.248.211.38]:46564: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
country_id: 1819730
description:
Feb  7 04:11:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
country_id: 1814991
description:
Feb  7 04:11:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
country_id: 6252001
description:
Feb  7 04:11:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.171.207.185
country_id: 6252001
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/images/images/engine1/images/engine1/engine1/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/images/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 04:12:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.204.108.172
country_id: 1814991
description:
Feb  7 04:12:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.204.108.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.204.108.172
country_id: 1814991
description:
2025-02-07 04:12:26 dovecot_plain authenticator failed for ([129.204.108.172]) [129.204.108.172]:54962: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.181.19.131
country_id: 3923057
description:
Feb  7 04:12:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.181.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.181.19.131
country_id: 3923057
description:
2025-02-07 04:12:31 dovecot_login authenticator failed for static-190-181-19-131.acelerate.net [190.181.19.131]:50586: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
country_id: 3658394
description:
Feb  7 04:13:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
country_id: 1562822
description:
Feb  7 04:13:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-07 04:13:58 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:58984: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.39.106
country_id: 1814991
description:
Feb  7 04:14:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
country_id: 6252001
description:
2025-02-07 04:14:09 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:43340: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
country_id: 3658394
description:
2025-02-07 04:13:50 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:37540: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
country_id: 1562822
description:
2025-02-07 04:13:51 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:59898: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
country_id: 6251999
description:
Feb  7 04:13:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.28.143
country_id: 1668284
description:
Feb  7 04:13:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.28.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.143
country_id: 1668284
description:
2025-02-07 04:14:01 dovecot_plain authenticator failed for 111-70-28-143.emome-ip.hinet.net [111.70.28.143]:36610: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
country_id: 6252001
description:
Feb  7 04:14:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.42.162
country_id: 6252001
description:
Feb  7 04:14:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.42.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.149.14
country_id: 1814991
description:
Feb  7 04:14:18 ait sshd[1583607]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.149.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.42.162
country_id: 6252001
description:
2025-02-07 04:14:20 dovecot_plain authenticator failed for c-73-95-42-162.hsd1.co.comcast.net [73.95.42.162]:38644: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-07 04:15:02 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:39772: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
country_id: 1814991
description:
Feb  7 04:15:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
country_id: 1814991
description:
2025-02-07 04:15:06 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:6990: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.39.106
country_id: 1814991
description:
2025-02-07 04:14:11 dovecot_plain authenticator failed for ([219.139.39.106]) [219.139.39.106]:40046: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 04:14:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.149.14
country_id: 1814991
description:
Feb  7 04:14:18 ait sshd[1583607]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.149.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 04:14:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Feb  7 04:15:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.172.61.145
country_id: 1814991
description:
2025-02-07 04:15:37 dovecot_plain authenticator failed for ([39.172.61.145]) [39.172.61.145]:52837: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
country_id: 1814991
description:
2025-02-07 04:15:42 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:9953: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.59.227
country_id: 3469034
description:
[2025-02-07 04:16:08 +0100] info [webmaild] 168.232.59.227 - info@ait.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
country_id: 2750405
description:
Feb  7 04:15:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.171.26
country_id: 1814991
description:
Feb  7 04:15:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.171.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.172.61.145
country_id: 1814991
description:
Feb  7 04:15:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.172.61.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.49
country_id: 1668284
description:
Feb  7 04:15:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
country_id: 1269750
description:
Feb  7 04:15:55 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
country_id: 1269750
description:
2025-02-07 04:15:57 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:47654: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2025-02-07 04:15:17 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:51234: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
country_id: 2750405
description:
2025-02-07 04:15:17 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:41536: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.164.235.208
country_id: 1814991
description:
2025-02-07 04:16:00 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:50927: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.171.26
country_id: 1814991
description:
2025-02-07 04:15:20 dovecot_plain authenticator failed for ([120.236.171.26]) [120.236.171.26]:56433: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
country_id: 1814991
description:
Feb  7 04:15:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.164.235.208
country_id: 1814991
description:
Feb  7 04:15:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.164.235.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
country_id: 1880251
description:
2025-02-07 04:16:19 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:54341: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.228.254
country_id: 1814991
description:
Feb  7 04:16:44 ait sshd[1584671]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.110.228.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
country_id: 1819730
description:
Feb  7 04:16:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.56.252.252
country_id: 2963597
description:
2025-02-07 04:17:06 dovecot_login authenticator failed for (ADMIN) [193.56.252.252]:39968: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
country_id: 290557
description:
Feb  7 04:16:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
country_id: 290557
description:
2025-02-07 04:16:19 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:51279: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.200.95.200
country_id: 2750405
description:
Feb  7 04:16:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.200.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
country_id: 298795
description:
2025-02-07 04:16:37 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:58541: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
country_id: 6252001
description:
2025-02-07 04:16:38 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:57869: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
country_id: 1819730
description:
2025-02-07 04:16:49 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:25359: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.228.194
country_id: 1880251
description:
Feb  7 04:16:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
country_id: 6252001
description:
Feb  7 04:16:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 36.110.228.254
country_id: 1814991
description:
Feb  7 04:17:03 ait sshd[1584671]: error: maximum authentication attempts exceeded for root from 36.110.228.254 port 18113 ssh2 [preauth]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.200.95.200
country_id: 2750405
description:
2025-02-07 04:16:24 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:58734: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
country_id: 298795
description:
Feb  7 04:16:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.110.228.254
country_id: 1814991
description:
Feb  7 04:16:44 ait sshd[1584671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.110.228.254  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 04:17:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 04:18:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
country_id: 1814991
description:
Feb  7 04:17:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
country_id: 1835841
description:
2025-02-07 04:17:48 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:20995: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
country_id: 1835841
description:
Feb  7 04:17:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
country_id: 1835841
description:
Feb  7 04:17:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  7 04:17:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
country_id: 1835841
description:
2025-02-07 04:17:36 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:59765: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
country_id: 1814991
description:
2025-02-07 04:17:46 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:10790: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-07 04:17:55 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:23369: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
country_id: 3469034
description:
Feb  7 04:18:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.108.12
country_id: 1814991
description:
2025-02-07 04:18:56 dovecot_plain authenticator failed for ([112.27.108.12]) [112.27.108.12]:33022: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
country_id: 1814991
description:
2025-02-07 04:18:58 dovecot_plain authenticator failed for ([39.165.154.222]) [39.165.154.222]:46082: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
country_id: 6252001
description:
Feb  7 04:19:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.113.240.74
country_id: 1861060
description:
2025-02-07 04:18:27 dovecot_plain authenticator failed for p169075-obmd01.osaka.ocn.ne.jp [61.113.240.74]:52953: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
country_id: 1814991
description:
Feb  7 04:18:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
country_id: 1814991
description:
Feb  7 04:18:56 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.169.42.135
country_id: 3469034
description:
Feb  7 04:18:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.169.42.135 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.56.2
country_id: 1880251
description:
47.128.56.2 - - [07/Feb/2025:04:18:36 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26801662" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.56.2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
country_id: 1814991
description:
2025-02-07 04:18:46 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:34450: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
country_id: 6252001
description:
2025-02-07 04:19:07 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:63455: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.149.14
country_id: 1814991
description:
Feb  7 04:18:16 ait sshd[1585057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.149.14  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
country_id: 2413451
description:
Feb  7 04:18:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
country_id: 3469034
description:
2025-02-07 04:19:01 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:33393: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.149.14
country_id: 1814991
description:
Feb  7 04:18:16 ait sshd[1585057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.149.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.206.128
country_id: 6252001
description:
Feb  7 04:18:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.206.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  7 04:18:43 ait sshd[1585285]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
country_id: 1814991
description:
Feb  7 04:18:43 ait sshd[1585285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
country_id: 2413451
description:
2025-02-07 04:18:44 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:38703: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.108.12
country_id: 1814991
description:
Feb  7 04:18:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.108.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.169.42.135
country_id: 3469034
description:
2025-02-07 04:19:01 dovecot_plain authenticator failed for ([45.169.42.135]) [45.169.42.135]:54574: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.41.206.128
country_id: 6252001
description:
2025-02-07 04:18:21 dovecot_login authenticator failed for (ADMIN) [181.41.206.128]:47798: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
country_id: 6252001
description:
2025-02-07 04:19:42 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:45639: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
country_id: 1835841
description:
2025-02-07 04:19:50 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:38764: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.194.43.140
country_id: 1861060
description:
Feb  7 04:19:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.194.43.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.200.71
country_id: 99237
description:
2025-02-07 04:19:19 dovecot_plain authenticator failed for (spolul) [65.20.200.71]:53334: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.171.137.226
country_id: 1814991
description:
Feb  7 04:19:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.171.137.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
country_id: 2077456
description:
2025-02-07 04:19:29 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:40783: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2025-02-07 04:19:30 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:59255: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
country_id: 3469034
description:
Feb  7 04:19:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
country_id: 3277605
description:
2025-02-07 04:19:37 dovecot_plain authenticator failed for ([195.222.57.182]) [195.222.57.190]:45204: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.149.14
country_id: 1814991
description:
Feb  7 04:20:05 ait sshd[1585783]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.149.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
country_id: 3277605
description:
Feb  7 04:19:35 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
country_id: 1835841
description:
Feb  7 04:19:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
country_id: 3469034
description:
2025-02-07 04:19:46 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:36405: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.24.121.89
country_id: 3175395
description:
Feb  7 04:19:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.24.121.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.137.226
country_id: 1814991
description:
2025-02-07 04:19:32 dovecot_plain authenticator failed for ([60.171.137.226]) [60.171.137.226]:44492: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.171.238
country_id: 1814991
description:
2025-02-07 04:19:45 dovecot_plain authenticator failed for ([124.115.171.238]) [124.115.171.238]:50103: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
country_id: 1819730
description:
Feb  7 04:20:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.194.43.140
country_id: 1861060
description:
2025-02-07 04:19:56 dovecot_plain authenticator failed for st0652.mas4401.y-tokyo.nttpc.ne.jp [61.194.43.140]:51400: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
country_id: 6252001
description:
Feb  7 04:19:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
country_id: 3175395
description:
2025-02-07 04:19:26 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:36670: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.131.79
country_id: 1814991
description:
2025-02-07 04:19:30 dovecot_plain authenticator failed for ([111.53.131.79]) [111.53.131.79]:52488: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
country_id: 1835841
description:
Feb  7 04:19:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
country_id: 2017370
description:
2025-02-07 04:19:51 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:52348: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-07 04:19:44 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:21560: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
country_id: 1814991
description:
Feb  7 04:19:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.200.71
country_id: 99237
description:
Feb  7 04:19:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.200.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
country_id: 1814991
description:
Feb  7 04:19:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
country_id: 6252001
description:
Feb  7 04:19:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
country_id: 6252001
description:
Feb  7 04:19:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.149.14
country_id: 1814991
description:
Feb  7 04:20:05 ait sshd[1585783]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.149.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.138.132.109
country_id: 1814991
description:
Feb  7 04:19:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.138.132.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.138.132.109
country_id: 1814991
description:
2025-02-07 04:19:33 dovecot_plain authenticator failed for ([36.138.132.109]) [36.138.132.109]:38262: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
country_id: 6252001
description:
2025-02-07 04:19:40 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:33040: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-07 04:19:49 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:57835: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
country_id: 6252001
description:
2025-02-07 04:19:12 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:36075: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
country_id: 3469034
description:
Feb  7 04:19:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
country_id: 953987
description:
2025-02-07 04:19:41 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:44513: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
country_id: 2017370
description:
Feb  7 04:19:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
country_id: 798544
description:
Feb  7 04:19:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  7 04:19:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.125.22.55
country_id: 3469034
description:
2025-02-07 04:19:27 dovecot_plain authenticator failed for ([177.125.22.55]) [177.125.22.55]:43811: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
country_id: 3469034
description:
2025-02-07 04:19:35 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:47032: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
country_id: 3469034
description:
2025-02-07 04:19:40 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:51127: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
country_id: 3469034
description:
Feb  7 04:19:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  7 04:19:40 ait sshd[1585602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
country_id: 1835841
description:
2025-02-07 04:19:48 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:60378: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-07 04:19:49 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:52982: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.143.57.91
country_id: 6252001
description:
Feb  7 04:19:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.143.57.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.36.108
country_id: 3932488
description:
Feb  7 04:19:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.36.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
country_id: 1814991
description:
Feb  7 04:19:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.36.108
country_id: 3932488
description:
2025-02-07 04:19:29 dovecot_plain authenticator failed for ([190.223.36.108]) [190.223.36.108]:41964: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
country_id: 6252001
description:
2025-02-07 04:19:39 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:53191: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.87.237
country_id: 1814991
description:
Feb  7 04:19:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.87.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.143.57.91
country_id: 6252001
description:
2025-02-07 04:19:28 dovecot_plain authenticator failed for (chil-vdsl-90.dsl.bright.net) [209.143.57.91]:35317: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.207.134
country_id: 1814991
description:
2025-02-07 04:19:31 dovecot_plain authenticator failed for ([221.2.207.134]) [221.2.207.134]:51946: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
country_id: 953987
description:
Feb  7 04:19:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
country_id: 3469034
description:
Feb  7 04:19:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.171.238
country_id: 1814991
description:
Feb  7 04:19:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.171.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-02-07 04:19:46 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:45346: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
country_id: 1814991
description:
2025-02-07 04:19:18 dovecot_plain authenticator failed for ([120.197.10.46]) [120.197.10.46]:44316: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.125.22.55
country_id: 3469034
description:
Feb  7 04:19:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.125.22.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.131.79
country_id: 1814991
description:
Feb  7 04:19:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.131.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
country_id: 953987
description:
2025-02-07 04:19:28 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:46329: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
country_id: 1269750
description:
2025-02-07 04:19:29 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:35696: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.210.170
country_id: 1814991
description:
2025-02-07 04:19:50 dovecot_plain authenticator failed for ([113.64.210.170]) [113.64.210.170]:40939: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.44.54
country_id: 1269750
description:
Feb  7 04:19:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.44.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.136.192.106
country_id: 1733045
description:
2025-02-07 04:19:29 dovecot_plain authenticator failed for ([175.136.192.106]) [175.136.192.106]:40896: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
country_id: 6252001
description:
Feb  7 04:19:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2025-02-07 04:19:39 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:34392: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  7 04:19:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
country_id: 953987
description:
Feb  7 04:19:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
country_id: 1269750
description:
Feb  7 04:19:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
country_id: 3469034
description:
2025-02-07 04:19:42 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:49338: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.87.237
country_id: 1814991
description:
2025-02-07 04:19:59 dovecot_plain authenticator failed for ([61.150.87.237]) [61.150.87.237]:52224: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  7 04:19:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.136.192.106
country_id: 1733045
description:
Feb  7 04:19:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.136.192.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
country_id: 1269750
description:
2025-02-07 04:19:31 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:53422: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
country_id: 1835841
description:
Feb  7 04:19:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
country_id: 1562822
description:
Feb  7 04:19:40 ait sshd[1585602]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
country_id: 798544
description:
2025-02-07 04:19:44 dovecot_plain authenticator failed for (24.81.41.31.ip4.feromedia.eu) [31.41.81.24]:33544: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
country_id: 1819730
description:
2025-02-07 04:20:08 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:54707: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
country_id: 3175395
description:
Feb  7 04:19:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
country_id: 2077456
description:
Feb  7 04:19:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.24.121.89
country_id: 3175395
description:
2025-02-07 04:19:28 dovecot_plain authenticator failed for ([212.24.121.89]) [212.24.121.89]:41818: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
country_id: 99237
description:
Feb  7 04:19:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.210.170
country_id: 1814991
description:
Feb  7 04:19:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.210.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
country_id: 1814991
description:
Feb  7 04:21:00 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.199.18
country_id: 1269750
description:
2025-02-07 04:20:51 dovecot_plain authenticator failed for ([103.132.199.18]) [103.132.199.18]:44673: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.196.30.122
country_id: 1269750
description:
Feb  7 04:20:54 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.196.30.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.196.30.122
country_id: 1269750
description:
2025-02-07 04:20:56 dovecot_plain authenticator failed for ([103.196.30.122]) [103.196.30.122]:35623: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
country_id: 2017370
description:
2025-02-07 04:20:51 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:48216: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
country_id: 1835841
description:
Feb  7 04:20:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
country_id: 1269750
description:
2025-02-07 04:20:15 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:50203: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
country_id: 2017370
description:
Feb  7 04:20:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.119.126.81
country_id: 1835841
description:
Feb  7 04:20:51 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.119.126.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
country_id: 1835841
description:
2025-02-07 04:20:55 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:54738: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
country_id: 1861060
description:
Feb  7 04:21:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
country_id: 6252001
description:
2025-02-07 04:21:05 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:59975: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.124.149.14
country_id: 1814991
description:
Feb  7 04:20:09 ait sshd[1585783]: Disconnected from invalid user fps 125.124.149.14 port 52454 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
country_id: 1269750
description:
Feb  7 04:20:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.188.149.243
country_id: 3923057
description:
Feb  7 04:20:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.188.149.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.188.149.243
country_id: 3923057
description:
2025-02-07 04:20:31 dovecot_plain authenticator failed for (scz-181-188-149-00243.tigo.bo) [181.188.149.243]:57132: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.126.81
country_id: 1835841
description:
2025-02-07 04:20:53 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:48694: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
country_id: 1814991
description:
2025-02-07 04:21:02 dovecot_plain authenticator failed for ([39.155.170.146]) [39.155.170.146]:38878: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
country_id: 6252001
description:
Feb  7 04:21:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
country_id: 1269750
description:
Feb  7 04:20:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
country_id: 1835841
description:
Feb  7 04:20:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
country_id: 1835841
description:
2025-02-07 04:20:27 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:50918: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
country_id: 1861060
description:
2025-02-07 04:21:05 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:33910: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
country_id: 3175395
description:
Feb  7 04:21:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
country_id: 6251999
description:
Feb  7 04:21:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.189
country_id: 1819730
description:
Feb  7 04:22:01 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.158.215
country_id: 2017370
description:
2025-02-07 04:21:55 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:57882: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
country_id: 1819730
description:
2025-02-07 04:21:44 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:52053: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.158.215
country_id: 2017370
description:
Feb  7 04:21:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.158.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.174.115.228
country_id: 3469034
description:
[2025-02-07 04:21:55 +0100] info [webmaild] 45.174.115.228 - info@ait-edu.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
country_id: 1835841
description:
Feb  7 04:22:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.189
country_id: 1819730
description:
2025-02-07 04:22:03 dovecot_plain authenticator failed for 189.46.246.220.static.netvigator.com [220.246.46.189]:64449: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
country_id: 3175395
description:
2025-02-07 04:21:17 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:58314: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.102.141.124
country_id: 6252001
description:
2025-02-07 04:21:27 dovecot_plain authenticator failed for ([75.102.141.124]) [75.102.141.124]:52151: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.31
country_id: 1819730
description:
Feb  7 04:21:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.31
country_id: 1819730
description:
2025-02-07 04:21:40 dovecot_plain authenticator failed for (m121-202-200-31.smartone.com) [121.202.200.31]:64886: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
country_id: 6251999
description:
2025-02-07 04:21:52 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:51182: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
country_id: 1835841
description:
2025-02-07 04:22:05 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:43136: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.102.141.124
country_id: 6252001
description:
Feb  7 04:21:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.102.141.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.250.225.23
country_id: 6252001
description:
Feb  7 04:21:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.250.225.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.250.225.23
country_id: 6252001
description:
2025-02-07 04:21:27 dovecot_plain authenticator failed for syn-172-250-225-023.res.spectrum.com [172.250.225.23]:37328: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
country_id: 1562822
description:
Feb  7 04:22:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
country_id: 1668284
description:
2025-02-07 04:22:44 dovecot_login authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:40190: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
country_id: 1668284
description:
Feb  7 04:22:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  7 04:22:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
country_id: 1835841
description:
Feb  7 04:22:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
country_id: 1668284
description:
2025-02-07 04:22:17 dovecot_plain authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:34788: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
country_id: 6290252
description:
2025-02-07 04:22:29 dovecot_plain authenticator failed for (static-TB-132-226.kbcnet.rs) [91.234.132.226]:34482: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.226
country_id: 1819730
description:
Feb  7 04:22:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
country_id: 6290252
description:
Feb  7 04:22:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.226
country_id: 1819730
description:
2025-02-07 04:22:28 dovecot_login authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:58287: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
country_id: 1562822
description:
2025-02-07 04:22:35 dovecot_login authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:37700: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-07 04:22:14 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:42361: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.106
country_id: 1668284
description:
Feb  7 04:22:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
country_id: 1814991
description:
Feb  7 04:22:19 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
country_id: 1814991
description:
2025-02-07 04:22:21 dovecot_login authenticator failed for ([116.116.108.165]) [116.116.108.165]:45485: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.0.25
country_id: 3469034
description:
[2025-02-07 04:23:06 +0100] info [webmaild] 179.108.0.25 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2025-02-07 04:22:15 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:54668: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.57.221
country_id: 2017370
description:
Feb  7 04:22:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.57.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.57.221
country_id: 2017370
description:
2025-02-07 04:22:22 dovecot_plain authenticator failed for ([95.79.57.221]) [95.79.57.221]:59218: 535 Incorrect authentication data (set_id=rnunator)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-23.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
country_id: 1643084
description:
2025-02-07 04:24:16 dovecot_login authenticator failed for ([103.145.27.106]) [103.145.27.1]:56324: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.100.181
country_id: 2017370
description:
2025-02-07 04:24:43 dovecot_plain authenticator failed for (broadband-37.204-100-181.ip.moscow.rt.ru) [37.204.100.181]:52932: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
country_id: 2077456
description:
2025-02-07 04:25:08 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:52014: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 04:24:31 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
country_id: 2017370
description:
2025-02-07 04:24:39 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:56312: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.132.199.18
country_id: 1269750
description:
Feb  7 04:24:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.132.199.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
country_id: 1835841
description:
2025-02-07 04:25:00 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:58477: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
country_id: 1835841
description:
2025-02-07 04:24:46 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:40900: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
country_id: 2077456
description:
Feb  7 04:25:06 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.161
country_id: 1819730
description:
2025-02-07 04:25:06 dovecot_plain authenticator failed for ([121.202.154.161]) [121.202.154.161]:51074: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.102.188.188
country_id: 1668284
description:
2025-02-07 04:24:52 dovecot_plain authenticator failed for (59-102-188-188.nty.dynamic.tbcnet.net.tw) [59.102.188.188]:33067: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.132.199.18
country_id: 1269750
description:
2025-02-07 04:24:52 dovecot_plain authenticator failed for ([103.132.199.18]) [103.132.199.18]:51984: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.147.37
country_id: 1269750
description:
2025-02-07 04:24:53 dovecot_plain authenticator failed for ([203.193.147.37]) [203.193.147.37]:54111: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.17.157.96
country_id: 3469034
description:
[2025-02-07 04:24:28 +0100] info [webmaild] 201.17.157.96 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.25.18
country_id: 1835841
description:
2025-02-07 04:24:34 dovecot_login authenticator failed for ([112.184.25.18]) [112.184.25.18]:47385: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
country_id: 6252001
description:
2025-02-07 04:24:41 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:55238: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
country_id: 1861060
description:
2025-02-07 04:24:42 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:64825: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
country_id: 732800
description:
2025-02-07 04:24:45 dovecot_plain authenticator failed for ([45.65.68.104]) [45.65.68.104]:41416: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.252
country_id: 1835841
description:
2025-02-07 04:24:55 dovecot_plain authenticator failed for ([211.247.127.252]) [211.247.127.252]:57214: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
country_id: 1269750
description:
2025-02-07 04:24:59 dovecot_plain authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:4142: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
country_id: 3175395
description:
2025-02-07 04:25:07 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:54367: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.66.113.58
country_id: 1814991
description:
2025-02-07 04:25:11 dovecot_plain authenticator failed for ([183.66.113.58]) [183.66.113.58]:43194: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.11.241.139
country_id: 1814991
description:
2025-02-07 04:27:04 dovecot_plain authenticator failed for ([112.11.241.139]) [112.11.241.139]:36003: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-07 04:26:14 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:57942: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.51
country_id: 1814991
description:
2025-02-07 04:26:28 dovecot_login authenticator failed for ([157.122.198.51]) [157.122.198.51]:45609: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
country_id: 1814991
description:
2025-02-07 04:26:33 dovecot_plain authenticator failed for ([116.114.84.170]) [116.114.84.170]:57692: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 04:26:38 dovecot_plain authenticator failed for ([223.80.109.135]) [27.223.100.90]:45420: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
country_id: 6252001
description:
2025-02-07 04:26:42 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:58222: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2025-02-07 04:26:50 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:40415: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
country_id: 294640
description:
2025-02-07 04:27:46 dovecot_plain authenticator failed for bzq-85-130-207-117.static.bezeqint.net [85.130.207.117]:48186: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 5.161.90.48
country_id: 6252001
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:04-27.5.161.90.48


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2025-02-07 04:27:32 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:49352: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
country_id: 1835841
description:
2025-02-07 04:27:49 dovecot_plain authenticator failed for ([218.146.45.68]) [218.146.45.68]:46309: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  7 04:28:03 ait sshd[1588696]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
country_id: 1835841
description:
2025-02-07 04:27:24 dovecot_plain authenticator failed for ([119.206.34.142]) [119.206.34.142]:44536: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-07 04:27:58 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:54040: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
country_id: 6252001
description:
Feb  7 04:28:03 ait sshd[1588696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 04:27:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.4
country_id: 1835841
description:
2025-02-07 04:27:15 dovecot_plain authenticator failed for ([203.252.10.4]) [203.252.10.4]:15371: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-07 04:27:21 dovecot_plain authenticator failed for ([180.149.214.193]) [110.38.70.172]:60885: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 04:28:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 38.62.224.40
country_id: 6252001
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-28.38.62.224.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
country_id: 1835841
description:
Feb  7 04:28:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
country_id: 1835841
description:
2025-02-07 04:28:38 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:37336: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
country_id: 290557
description:
2025-02-07 04:28:10 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:33187: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
country_id: 1814991
description:
2025-02-07 04:28:11 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:59438: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
country_id: 1814991
description:
2025-02-07 04:28:13 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:47283: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
country_id: 2017370
description:
2025-02-07 04:28:22 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:38282: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.32.126.224
country_id: 3017382
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads21a00012y||WPU:ads21a00012y||RSV:6.65||T:APACHE||MV:04-28.193.32.126.224


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.114.194.67
country_id: 1814991
description:
Feb  7 04:29:33 ait sshd[1589018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.114.194.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.114.194.67
country_id: 1814991
description:
Feb  7 04:29:33 ait sshd[1589018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.114.194.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.34.230.4
country_id: 1835841
description:
2025-02-07 04:29:47 dovecot_plain authenticator failed for ([118.34.230.4]) [118.34.230.4]:38808: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.21
country_id: 1269750
description:
2025-02-07 04:29:58 dovecot_plain authenticator failed for (nsg-corporate-21.229.187.122.airtel.in) [122.187.229.21]:48884: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.238.147.175
country_id: 3469034
description:
Feb  7 04:30:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.238.147.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
country_id: 1819730
description:
Feb  7 04:30:13 ait sshd[1589387]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
country_id: 1819730
description:
Feb  7 04:30:13 ait sshd[1589387]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.247.74
country_id: 1814991
description:
2025-02-07 04:30:17 dovecot_plain authenticator failed for ([183.234.247.74]) [183.234.247.74]:38431: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 04:30:21 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
country_id: 1880251
description:
2025-02-07 04:30:25 dovecot_plain authenticator failed for (228.10.245.49.unknown.m1.com.sg) [49.245.10.228]:40063: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 04:30:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2025-02-07 04:33:09 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:50204: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
country_id: 6252001
description:
2025-02-07 04:33:02 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:57316: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.52
country_id: 1269750
description:
2025-02-07 04:33:22 dovecot_login authenticator failed for ([103.146.233.52]) [103.146.233.52]:58526: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
country_id: 3469034
description:
2025-02-07 04:33:18 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:58538: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
country_id: 290557
description:
2025-02-07 04:33:52 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:58567: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.211.130.219
country_id: 1512440
description:
2025-02-07 04:34:02 dovecot_plain authenticator failed for ([185.211.130.219]) [185.211.130.219]:38621: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.7
country_id: 2542007
description:
2025-02-07 04:33:47 dovecot_login authenticator failed for (ADMIN) [95.181.232.7]:36394: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-07 04:33:29 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:51331: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 04:33:38 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.138
country_id: 3077311
description:
Feb  7 04:33:50 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
country_id: 2017370
description:
2025-02-07 04:33:54 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:58104: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
country_id: 3469034
description:
2025-02-07 04:34:05 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:47693: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
country_id: 3469034
description:
2025-02-07 04:33:17 dovecot_plain authenticator failed for (191.34.34.41.static.adsl.gvt.net.br) [177.159.150.111]:46471: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.138
country_id: 3077311
description:
2025-02-07 04:33:52 dovecot_login authenticator failed for (ADMIN) [212.102.39.138]:36576: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.102
country_id: 1880251
description:
47.128.118.102 - - [07/Feb/2025:04:34:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19507918 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C125%2C30&filter_course-language=121&filtering=1&instructor=2%2C1&price_type=paid&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.102


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 04:33:24 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.49.61.211
country_id: 6252001
description:
2025-02-07 04:34:33 dovecot_plain authenticator failed for ([136.49.61.211]) [136.49.61.211]:44760: 535 Incorrect authentication data (set_id=jkudzie)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.163.100.11
country_id: 1880251
domain: elmisa.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/assets/images/28c5400b0b.php||SC:/home/elmisa/public_html/assets


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.163.100.11
country_id: 1880251
domain: elmisa.com
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-34.52.163.100.11||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.67.14
country_id: 6252001
description:
2025-02-07 04:35:03 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:41050: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
country_id: 1814991
description:
2025-02-07 04:34:27 dovecot_login authenticator failed for ([60.14.36.47]) [60.14.36.47]:56690: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-02-07 04:34:24 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:58602: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 04:34:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
country_id: 2017370
description:
2025-02-07 04:34:30 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:50632: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.102
country_id: 1814991
description:
2025-02-07 04:34:31 dovecot_plain authenticator failed for ([111.48.214.102]) [111.48.214.102]:30308: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
country_id: 1814991
description:
2025-02-07 04:34:39 dovecot_login authenticator failed for ([59.34.17.130]) [59.34.17.130]:35437: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
country_id: 3469034
description:
2025-02-07 04:34:39 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:46834: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.12.219
country_id: 1668284
description:
Feb  7 04:34:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.12.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
country_id: 1835841
description:
2025-02-07 04:34:52 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:46403: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
country_id: 6252001
description:
2025-02-07 04:34:39 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:55316: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
country_id: 2328926
description:
2025-02-07 04:34:46 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:38176: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.12.219
country_id: 1668284
description:
2025-02-07 04:34:24 dovecot_plain authenticator failed for 111-70-12-219.emome-ip.hinet.net [111.70.12.219]:42430: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.231.102.189
country_id: 6252001
description:
2025-02-07 04:35:50 dovecot_plain authenticator failed for ([73.231.102.189]) [73.231.102.189]:51736: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
country_id: 1814991
description:
2025-02-07 04:35:55 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:10955: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
country_id: 1814991
description:
2025-02-07 04:36:05 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:47021: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
country_id: 3469034
description:
2025-02-07 04:35:34 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:16235: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
country_id: 2017370
description:
2025-02-07 04:35:38 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:33650: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.20.91.38
country_id: 3469034
description:
[2025-02-07 04:36:52 +0100] info [webmaild] 160.20.91.38 - info@lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
country_id: 3469034
description:
2025-02-07 04:37:01 dovecot_login authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:40721: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 04:36:29 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.80.209
country_id: 294640
description:
2025-02-07 04:36:52 dovecot_login authenticator failed for (2-55-80-209.orange.net.il) [2.55.80.209]:33032: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
country_id: 1835841
description:
2025-02-07 04:37:01 dovecot_plain authenticator failed for ([183.108.254.67]) [183.108.254.67]:47737: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.123.175.194
country_id: 1814991
description:
2025-02-07 04:37:07 dovecot_login authenticator failed for ([183.56.179.201]) [119.123.175.194]:15190: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-07 04:36:11 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:59018: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
country_id: 102358
description:
2025-02-07 04:37:07 dovecot_login authenticator failed for ([37.224.119.19]) [37.224.119.19]:42374: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 04:37:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
country_id: 1269750
description:
2025-02-07 04:37:09 dovecot_login authenticator failed for ([110.226.126.143]) [103.250.149.90]:51012: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-07 04:36:45 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:47636: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
country_id: 3996063
description:
2025-02-07 04:36:48 dovecot_login authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:60296: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.162.249
country_id: 1668284
description:
2025-02-07 04:37:25 dovecot_plain authenticator failed for 1-34-162-249.hinet-ip.hinet.net [1.34.162.249]:49375: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
country_id: 1269750
description:
2025-02-07 04:37:28 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:47089: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 04:38:07 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.188.202
country_id: 1814991
description:
2025-02-07 04:37:24 dovecot_login authenticator failed for ([120.197.188.202]) [120.197.188.202]:48507: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.193.199.39
country_id: 1814991
description:
2025-02-07 04:37:37 dovecot_plain authenticator failed for ([221.193.199.39]) [221.193.199.39]:59757: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.9.236
country_id: 1814991
description:
2025-02-07 04:37:37 dovecot_login authenticator failed for ([210.21.9.236]) [210.21.9.236]:51700: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2025-02-07 04:37:46 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:57528: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.42.181
country_id: 1880251
description:
47.128.42.181 - - [07/Feb/2025:04:37:51 +0100] "GET /images/facebook.png HTTP/2.0" 415 176 mail.ait-edu.us "https://mail.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7180761" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.42.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
country_id: 3469034
description:
2025-02-07 04:38:43 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:40011: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
country_id: 1835841
description:
2025-02-07 04:38:17 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:45942: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
country_id: 1814991
description:
2025-02-07 04:40:06 dovecot_login authenticator failed for ([116.132.43.94]) [116.132.43.94]:6726: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
country_id: 1835841
description:
2025-02-07 04:39:20 dovecot_login authenticator failed for ([1.224.58.243]) [1.224.58.243]:34916: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
country_id: 3469034
description:
2025-02-07 04:39:41 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:35127: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2025-02-07 04:39:44 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:53920: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
country_id: 1814991
description:
2025-02-07 04:39:49 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:55644: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
country_id: 2077456
description:
2025-02-07 04:40:03 dovecot_plain authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:36648: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
country_id: 1814991
description:
2025-02-07 04:39:31 dovecot_login authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:38203: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
country_id: 1814991
description:
2025-02-07 04:39:37 dovecot_plain authenticator failed for ([112.31.167.120]) [112.31.167.120]:53259: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
country_id: 732800
description:
2025-02-07 04:39:45 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:43422: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.238
country_id: 337996
description:
2025-02-07 04:40:14 dovecot_login authenticator failed for ([196.191.212.238]) [196.191.212.238]:51620: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.46.114
country_id: 1269750
description:
2025-02-07 04:40:36 dovecot_login authenticator failed for ([125.20.46.114]) [125.20.46.114]:35362: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
country_id: 1814991
description:
2025-02-07 04:40:53 dovecot_login authenticator failed for ([36.112.75.46]) [36.112.75.46]:62320: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
country_id: 1814991
description:
2025-02-07 04:41:03 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:40502: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.157.15
country_id: 1814991
description:
2025-02-07 04:40:20 dovecot_login authenticator failed for ([218.14.157.15]) [218.14.157.15]:53416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.39.63.46
country_id: 1814991
description:
2025-02-07 04:40:58 dovecot_plain authenticator failed for ([117.39.63.46]) [117.39.63.46]:44266: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
country_id: 1819730
description:
2025-02-07 04:40:58 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:33480: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
country_id: 1814991
description:
2025-02-07 04:41:00 dovecot_login authenticator failed for ([221.195.72.195]) [221.195.208.171]:12448: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
country_id: 1835841
description:
2025-02-07 04:41:02 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:53200: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
country_id: 614540
description:
2025-02-07 04:41:04 dovecot_login authenticator failed for ([2.57.219.14]) [2.57.219.2]:51722: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.245.95.11
country_id: 1562822
description:
2025-02-07 04:42:08 dovecot_plain authenticator failed for ([210.245.95.11]) [210.245.95.11]:55350: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.218
country_id: 3865483
description:
2025-02-07 04:42:09 dovecot_plain authenticator failed for (201-234-106-218.static.impsat.net.ar) [201.234.106.218]:47623: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2025-02-07 04:41:18 dovecot_login authenticator failed for ([167.250.118.53]) [167.250.118.53]:58656: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.227.238
country_id: 1835841
description:
2025-02-07 04:41:39 dovecot_login authenticator failed for ([221.163.227.238]) [221.163.227.238]:38583: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 111.70.2.198
country_id: 1668284
description:
Feb  7 04:41:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(111.70.2.198)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.83.78
country_id: 1269750
description:
2025-02-07 04:41:50 dovecot_plain authenticator failed for ([182.78.83.78]) [182.78.83.78]:39330: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
country_id: 1814991
description:
2025-02-07 04:41:54 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:44268: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
country_id: 1835841
description:
2025-02-07 04:42:10 dovecot_plain authenticator failed for ([14.37.79.247]) [14.37.79.247]:58901: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.90.239.158
country_id: 1835841
description:
2025-02-07 04:42:10 dovecot_plain authenticator failed for (mail.salee.co.kr) [220.90.239.158]:51208: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
country_id: 1835841
description:
2025-02-07 04:41:22 dovecot_login authenticator failed for ([125.132.52.129]) [221.163.182.162]:36635: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
country_id: 1819730
description:
2025-02-07 04:42:03 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:58123: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
country_id: 3469034
description:
2025-02-07 04:42:03 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:58320: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2025-02-07 04:42:01 dovecot_plain authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:44041: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-07 04:42:07 dovecot_plain authenticator failed for ([203.252.10.3]) [203.252.10.3]:26453: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2025-02-07 04:42:08 dovecot_plain authenticator failed for ([116.113.254.26]) [116.113.254.26]:53368: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
country_id: 1269750
description:
2025-02-07 04:41:49 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:57608: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-02-07 04:41:51 dovecot_plain authenticator failed for ([47.206.63.169]) [47.206.63.169]:57352: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
country_id: 1814991
description:
2025-02-07 04:41:55 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:43300: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
country_id: 1835841
description:
2025-02-07 04:42:07 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:42643: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
country_id: 1835841
description:
2025-02-07 04:42:07 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:37676: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
country_id: 1814991
description:
2025-02-07 04:42:06 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:32072: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
country_id: 1835841
description:
2025-02-07 04:42:06 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:34330: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
country_id: 1668284
description:
2025-02-07 04:41:47 dovecot_login authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:59763: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
country_id: 6252001
description:
2025-02-07 04:41:49 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:42893: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
country_id: 1880251
description:
2025-02-07 04:41:50 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:48405: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.203.254
country_id: 1814991
description:
2025-02-07 04:41:52 dovecot_plain authenticator failed for (hebei.2.60.in-addr.arpa) [60.2.203.254]:53016: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
country_id: 6252001
description:
2025-02-07 04:41:53 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:47504: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
country_id: 1814991
description:
2025-02-07 04:41:57 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:39073: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2025-02-07 04:42:08 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:59294: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
country_id: 2017370
description:
2025-02-07 04:41:12 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:7847: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
country_id: 290557
description:
2025-02-07 04:41:48 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:39021: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
country_id: 2400553
description:
2025-02-07 04:42:05 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:45283: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
country_id: 1814991
description:
2025-02-07 04:42:09 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:42574: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
country_id: 1814991
description:
2025-02-07 04:41:54 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:45606: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
country_id: 1269750
description:
2025-02-07 04:41:54 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:55088: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
country_id: 3469034
description:
2025-02-07 04:41:19 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:54927: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 221.163.182.162
country_id: 1835841
description:
Feb  7 04:41:20 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(221.163.182.162)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.19.225
country_id: 6252001
description:
2025-02-07 04:41:59 dovecot_plain authenticator failed for 24.115.19.225.res-cmts.sm3.ptd.net [24.115.19.225]:54156: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.136.195.32
country_id: 1814991
description:
2025-02-07 04:42:03 dovecot_plain authenticator failed for (32.195.136.122.adsl-pool.jlccptt.net.cn) [122.136.195.32]:55567: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
country_id: 1814991
description:
2025-02-07 04:42:05 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:39717: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
country_id: 1814991
description:
2025-02-07 04:42:08 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:39233: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.232.117.127
country_id: 1668284
description:
2025-02-07 04:41:53 dovecot_plain authenticator failed for 118-232-117-127.dynamic.kbronet.com.tw [118.232.117.127]:54305: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-02-07 04:41:51 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:1125: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2025-02-07 04:41:51 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:33297: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-07 04:42:01 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:46613: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.80.11
country_id: 1269750
description:
2025-02-07 04:41:11 dovecot_login authenticator failed for ([182.156.80.11]) [182.156.80.11]:38912: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2025-02-07 04:41:55 dovecot_login authenticator failed for ([61.81.133.182]) [61.81.133.182]:36498: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
country_id: 3469034
description:
2025-02-07 04:41:54 dovecot_plain authenticator failed for ([181.233.140.250]) [181.233.140.250]:51536: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
country_id: 2395170
description:
2025-02-07 04:41:59 dovecot_plain authenticator failed for ([154.127.43.35]) [154.127.43.35]:60979: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 167.250.118.53
country_id: 3865483
description:
Feb  7 04:41:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(167.250.118.53)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.227.248.225
country_id: 1814991
description:
2025-02-07 04:41:18 dovecot_plain authenticator failed for ([139.227.248.225]) [139.227.248.225]:58474: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 221.163.227.238
country_id: 1835841
description:
Feb  7 04:41:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(221.163.227.238)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.42.74
country_id: 1814991
description:
2025-02-07 04:41:52 dovecot_plain authenticator failed for ([58.18.42.74]) [58.18.42.74]:54625: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.53.76
country_id: 6252001
description:
2025-02-07 04:41:54 dovecot_plain authenticator failed for ([24.121.53.76]) [24.121.53.76]:47034: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-07 04:41:50 dovecot_plain authenticator failed for ([216.194.174.86]) [216.194.174.27]:56317: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 61.81.133.182
country_id: 1835841
description:
Feb  7 04:41:53 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(61.81.133.182)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
country_id: 1835841
description:
2025-02-07 04:41:53 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:33606: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
country_id: 294640
description:
2025-02-07 04:42:00 dovecot_plain authenticator failed for mail.infologic.co.il [85.130.200.51]:35697: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 124.246.94.219
country_id: 1880251
description:
Feb  7 04:42:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(124.246.94.219)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.248.169.140
country_id: 1814991
description:
2025-02-07 04:42:32 dovecot_login authenticator failed for ([58.248.169.140]) [58.248.169.140]:45035: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.94.219
country_id: 1880251
description:
2025-02-07 04:42:45 dovecot_login authenticator failed for ([124.246.94.219]) [124.246.94.219]:46917: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 108.235.203.63
country_id: 6252001
description:
Feb  7 04:42:57 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(108.235.203.63)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.5
country_id: 6252001
description:
2025-02-07 04:42:15 dovecot_plain authenticator failed for ([104.241.235.5]) [104.241.235.5]:33778: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
country_id: 1814991
description:
2025-02-07 04:42:30 dovecot_plain authenticator failed for ([218.22.187.69]) [218.22.187.66]:39073: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.68
country_id: 6251999
description:
2025-02-07 04:42:39 dovecot_login authenticator failed for s142-59-214-68.ab.hsia.telus.net [142.59.214.68]:36328: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
country_id: 1835841
description:
2025-02-07 04:42:19 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:56638: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
country_id: 1814991
description:
2025-02-07 04:42:25 dovecot_plain authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:39919: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.114.101
country_id: 1512440
description:
[2025-02-07 04:42:35 +0100] info [webmaild] 213.230.114.101 - info@ait-ext.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
country_id: 6252001
description:
2025-02-07 04:42:29 dovecot_plain authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com [44.211.191.117]:45522: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.237.145.18
country_id: 3469034
description:
2025-02-07 04:42:36 dovecot_plain authenticator failed for ([186.237.145.18]) [186.237.145.18]:65509: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
country_id: 6252001
description:
2025-02-07 04:42:16 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:43782: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 113.219.177.95
country_id: 1814991
description:
Feb  7 04:42:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(113.219.177.95)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.57.33.221
country_id: 1269750
description:
2025-02-07 04:42:19 dovecot_plain authenticator failed for ([120.57.33.221]) [120.57.33.221]:47070: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.15.163.18
country_id: 6252001
description:
2025-02-07 04:42:20 dovecot_plain authenticator failed for wsip-68-15-163-18.no.no.cox.net [68.15.163.18]:41665: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.0.0.21
country_id: 3469034
description:
[2025-02-07 04:42:13 +0100] info [webmaild] 206.0.0.21 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
country_id: 6252001
description:
2025-02-07 04:42:15 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net ([70.166.207.65]) [70.166.207.76]:44978: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 58.248.169.140
country_id: 1814991
description:
Feb  7 04:42:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(58.248.169.140)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 142.59.214.68
country_id: 6251999
description:
Feb  7 04:42:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(142.59.214.68)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
country_id: 1814991
description:
2025-02-07 04:42:41 dovecot_plain authenticator failed for ([112.194.143.206]) [112.194.143.206]:35758: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.235.203.63
country_id: 6252001
description:
2025-02-07 04:42:59 dovecot_login authenticator failed for 108-235-203-63.lightspeed.chrlnc.sbcglobal.net [108.235.203.63]:64165: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
country_id: 1819730
description:
2025-02-07 04:42:12 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:48672: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.219.177.95
country_id: 1814991
description:
2025-02-07 04:42:20 dovecot_login authenticator failed for ([113.219.177.95]) [113.219.177.95]:50898: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
country_id: 1831722
description:
2025-02-07 04:44:02 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:5506: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 1.180.230.98
country_id: 1814991
description:
Feb  7 04:43:22 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(1.180.230.98)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
country_id: 1814991
description:
2025-02-07 04:43:24 dovecot_login authenticator failed for ([1.180.230.98]) [1.180.230.98]:48598: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.25.233.22
country_id: 1814991
description:
2025-02-07 04:43:29 dovecot_login authenticator failed for ([218.25.233.22]) [218.25.233.22]:42340: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.216.172.182
country_id: 3469034
description:
2025-02-07 04:43:44 dovecot_login authenticator failed for ([200.216.172.182]) [200.216.172.182]:54185: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
country_id: 2750405
description:
2025-02-07 04:43:28 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:49880: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 27.45.234.46
country_id: 1814991
description:
Feb  7 04:43:36 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(27.45.234.46)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
country_id: 2017370
description:
2025-02-07 04:43:38 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:57428: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
country_id: 1814991
description:
2025-02-07 04:44:02 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:51014: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
country_id: 1814991
description:
2025-02-07 04:44:03 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:37590: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 04:43:56 ait sshd[1594321]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 04:43:56 ait sshd[1594321]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 218.25.233.22
country_id: 1814991
description:
Feb  7 04:43:27 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(218.25.233.22)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.234.46
country_id: 1814991
description:
2025-02-07 04:43:38 dovecot_login authenticator failed for ([27.45.234.46]) [27.45.234.46]:49555: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 200.216.172.182
country_id: 3469034
description:
Feb  7 04:43:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(200.216.172.182)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
country_id: 798544
description:
2025-02-07 04:44:34 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:37502: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
country_id: 1835841
description:
2025-02-07 04:44:34 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:36710: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
country_id: 2510769
description:
2025-02-07 04:44:35 dovecot_login authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:34539: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
country_id: 1269750
description:
2025-02-07 04:44:38 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.142.238]:33399: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.34
country_id: 617790
description:
Feb  7 04:44:47 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
country_id: 2017370
description:
2025-02-07 04:44:25 dovecot_login authenticator failed for (188.227.66.92.prometeyhome.net) [188.227.66.92]:51776: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.46.114
country_id: 1269750
description:
2025-02-07 04:44:32 dovecot_plain authenticator failed for ([125.20.46.114]) [125.20.46.114]:35396: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.34
country_id: 617790
description:
2025-02-07 04:44:49 dovecot_plain authenticator failed for ([185.167.56.34]) [185.167.56.34]:48420: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
country_id: 3595528
description:
2025-02-07 04:44:14 dovecot_plain authenticator failed for ([190.121.193.126]) [190.121.193.126]:50220: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
country_id: 298795
description:
2025-02-07 04:44:30 dovecot_login authenticator failed for ([5.11.164.165]) [5.11.164.165]:50068: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 188.227.66.92
country_id: 2017370
description:
Feb  7 04:44:23 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(188.227.66.92)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 195.24.215.70
country_id: 2233387
description:
Feb  7 04:45:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(195.24.215.70)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
country_id: 3469034
description:
2025-02-07 04:44:11 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:36710: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
country_id: 597427
description:
2025-02-07 04:44:24 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:44912: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
country_id: 953987
description:
2025-02-07 04:44:28 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:54795: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 20.188.105.240
country_id: 1880251
domain: titopen.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-44.20.188.105.240||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
country_id: 1880251
description:
2025-02-07 04:44:29 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:2495: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
country_id: 1819730
description:
2025-02-07 04:44:39 dovecot_plain authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:39275: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.233.179
country_id: 798544
description:
2025-02-07 04:44:48 dovecot_login authenticator failed for apn-87-251-233-179.static.gprs.plus.pl [87.251.233.179]:42528: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 150.9.7.174
country_id: 1861060
description:
Feb  7 04:44:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(150.9.7.174)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
country_id: 1814991
description:
2025-02-07 04:44:14 dovecot_login authenticator failed for ([58.210.188.130]) [58.210.188.130]:1276: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 61.169.54.150
country_id: 1814991
description:
Feb  7 04:44:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(61.169.54.150)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
country_id: 1814991
description:
2025-02-07 04:44:16 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:41466: 535 Incorrect authentication data (set_id=assdas1)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.188.105.240
country_id: 1880251
domain: titopen.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/assets/images/28c5400b0b.php||SC:/home/titlemas/public_html/titopen.us/assets


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 5.11.164.165
country_id: 298795
description:
Feb  7 04:44:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(5.11.164.165)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.149.10
country_id: 1269750
description:
2025-02-07 04:44:44 dovecot_login authenticator failed for (abts-north-dynamic-010.149.176.122.airtelbroadband.in) [122.176.149.10]:42680: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 58.210.188.130
country_id: 1814991
description:
Feb  7 04:44:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(58.210.188.130)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.43.202.110
country_id: 2017370
description:
2025-02-07 04:44:14 dovecot_plain authenticator failed for ([31.43.202.110]) [31.43.202.110]:40989: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.9.7.174
country_id: 1861060
description:
2025-02-07 04:44:15 dovecot_login authenticator failed for as007174.dynamic.ppp.asahi-net.or.jp [150.9.7.174]:38632: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
country_id: 1814991
description:
2025-02-07 04:44:54 dovecot_login authenticator failed for ([61.169.54.150]) [61.169.54.150]:41229: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
country_id: 1814991
description:
2025-02-07 04:44:25 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:46022: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
country_id: 2233387
description:
2025-02-07 04:45:06 dovecot_login authenticator failed for ([195.24.215.70]) [195.24.215.70]:51862: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 122.176.149.10
country_id: 1269750
description:
Feb  7 04:44:42 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@ait.edu.gh has been temporarily locked by Imunify PAM(122.176.149.10)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 87.251.233.179
country_id: 798544
description:
Feb  7 04:44:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(87.251.233.179)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
country_id: 3469034
description:
2025-02-07 04:44:18 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:49737: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 80.29.176.41
country_id: 2510769
description:
Feb  7 04:44:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(80.29.176.41)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.87.103.131
country_id: 2017370
description:
2025-02-07 04:45:25 dovecot_plain authenticator failed for ([77.87.103.131]) [77.87.103.131]:59968: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
country_id: 3996063
description:
2025-02-07 04:46:00 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:39676: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 115.22.146.235
country_id: 1835841
description:
Feb  7 04:45:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(115.22.146.235)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.146.235
country_id: 1835841
description:
2025-02-07 04:45:20 dovecot_login authenticator failed for ([115.22.146.235]) [115.22.146.235]:50298: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.40.138
country_id: 1814991
description:
2025-02-07 04:45:38 dovecot_plain authenticator failed for ([27.115.40.138]) [27.115.40.138]:43295: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.114.163
country_id: 1880251
description:
47.128.114.163 - - [07/Feb/2025:04:45:42 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20241055 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?filter_course-language=79%2C121&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.114.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
country_id: 1269750
description:
2025-02-07 04:45:51 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:34740: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.158.171.3
country_id: 1814991
description:
2025-02-07 04:46:02 dovecot_plain authenticator failed for ([61.158.171.3]) [61.158.171.3]:44532: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 103.146.233.202
country_id: 1269750
description:
Feb  7 04:45:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(103.146.233.202)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.202
country_id: 1269750
description:
2025-02-07 04:45:27 dovecot_login authenticator failed for ([103.146.233.202]) [103.146.233.202]:44874: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-07 04:45:36 dovecot_plain authenticator failed for ([216.194.174.80]) [216.194.174.27]:41223: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
country_id: 1814991
description:
2025-02-07 04:46:00 dovecot_plain authenticator failed for ([60.174.228.220]) [60.174.228.220]:35870: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
country_id: 1269750
description:
2025-02-07 04:45:48 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:33926: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.31.219
country_id: 1643084
description:
2025-02-07 04:45:53 dovecot_plain authenticator failed for ([103.115.31.219]) [103.115.31.219]:50636: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 158.69.23.79
country_id: 6251999
domain: jabmar.org
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-45.158.69.23.79||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
country_id: 3658394
description:
2025-02-07 04:45:27 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:39848: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.213.68
country_id: 3865483
description:
2025-02-07 04:46:12 dovecot_login authenticator failed for (red.138.118.213.068.ssservicios.com.ar) [138.118.213.68]:58322: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
country_id: 1210997
description:
2025-02-07 04:46:23 dovecot_login authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:50321: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
country_id: 1814991
description:
2025-02-07 04:46:17 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:35339: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.96.133
country_id: 1814991
description:
2025-02-07 04:46:19 dovecot_plain authenticator failed for ([61.185.96.133]) [61.185.96.133]:56086: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.57.75
country_id: 1880251
description:
47.128.57.75 - - [07/Feb/2025:04:46:31 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20684224 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=287" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.57.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.168.155.83
country_id: 3469034
description:
[2025-02-07 04:47:46 +0100] info [webmaild] 45.168.155.83 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
country_id: 1819730
description:
2025-02-07 04:47:47 dovecot_login authenticator failed for ([121.202.196.6]) [121.202.196.6]:21379: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
country_id: 2017370
description:
2025-02-07 04:47:51 dovecot_login authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:37132: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
country_id: 1814991
description:
2025-02-07 04:48:02 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:35690: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.25.18
country_id: 1835841
description:
2025-02-07 04:48:05 dovecot_login authenticator failed for ([112.184.25.18]) [112.184.25.18]:53310: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.181.184.222
country_id: 6252001
description:
Feb  7 04:48:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.181.184.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.181.184.222
country_id: 6252001
description:
2025-02-07 04:48:45 dovecot_login authenticator failed for (ADMIN) [107.181.184.222]:42102: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
country_id: 2635167
description:
2025-02-07 04:49:01 dovecot_login authenticator failed for ([217.32.209.50]) [217.32.209.51]:34011: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.105
country_id: 1880251
description:
47.128.43.105 - - [07/Feb/2025:04:49:02 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6656568 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=340&id=286&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.105


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
country_id: 1835841
description:
2025-02-07 04:49:03 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:34740: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
country_id: 1835841
description:
2025-02-07 04:48:50 dovecot_login authenticator failed for ([220.93.167.144]) [220.93.167.144]:54142: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
country_id: 1814991
description:
2025-02-07 04:48:54 dovecot_login authenticator failed for ([219.153.13.161]) [219.153.13.161]:57907: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.95.13.185
country_id: 6252001
description:
2025-02-07 04:49:02 dovecot_login authenticator failed for (74-95-13-185-SFBA.hfc.comcastbusiness.net) [74.95.13.185]:45096: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
country_id: 690791
description:
2025-02-07 04:48:49 dovecot_login authenticator failed for ([185.199.98.51]) [185.199.98.51]:48568: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-02-07 04:49:09 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:40599: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
country_id: 2017370
description:
2025-02-07 04:49:29 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:43062: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
country_id: 1819730
description:
Feb  7 04:49:42 ait sshd[1596267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
country_id: 1819730
description:
Feb  7 04:49:42 ait sshd[1596267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
country_id: 953987
description:
2025-02-07 04:51:06 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:45523: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.41.214
country_id: 1880251
description:
47.128.41.214 - - [07/Feb/2025:04:50:14 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12114980 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/fa8749?panel=translation" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.41.214


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.99.232
country_id: 3469034
description:
[2025-02-07 04:50:21 +0100] info [webmaild] 177.39.99.232 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
country_id: 2017370
description:
2025-02-07 04:50:54 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:51828: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.133.50
country_id: 2413451
description:
2025-02-07 04:51:03 dovecot_plain authenticator failed for ([197.231.133.50]) [197.231.133.50]:47401: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.14.83
country_id: 3996063
description:
2025-02-07 04:51:27 dovecot_plain authenticator failed for (187.161.14.83-clientes-izzi.mx) [187.161.14.83]:35779: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2025-02-07 04:51:31 dovecot_plain authenticator failed for 109.43.246.220.static.netvigator.com [220.246.43.109]:57400: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.129.123
country_id: 1819730
description:
2025-02-07 04:51:46 dovecot_plain authenticator failed for 123.129.198.203.static.netvigator.com [203.198.129.123]:58776: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
country_id: 1168579
description:
2025-02-07 04:51:46 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:36584: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
country_id: 1814991
description:
2025-02-07 04:51:46 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:54207: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.164.235.38
country_id: 3469034
description:
2025-02-07 04:51:33 dovecot_plain authenticator failed for ([205.164.235.34]) [205.164.235.38]:60320: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.138.101.106
country_id: 1814991
description:
2025-02-07 04:51:36 dovecot_plain authenticator failed for ([123.138.101.106]) [123.138.101.106]:38437: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2025-02-07 04:51:38 dovecot_login authenticator failed for 145.173.198.203.static.netvigator.com [203.198.173.145]:44903: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
country_id: 1819730
description:
2025-02-07 04:51:40 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:37044: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.62
country_id: 2077456
description:
2025-02-07 04:51:46 dovecot_plain authenticator failed for ([203.189.124.62]) [203.189.124.62]:34913: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
country_id: 294640
description:
2025-02-07 04:51:38 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:47912: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
country_id: 1814991
description:
2025-02-07 04:51:48 dovecot_plain authenticator failed for ([1.180.97.138]) [1.180.97.138]:57179: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2025-02-07 04:51:13 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:56630: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
country_id: 1835841
description:
2025-02-07 04:51:44 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:48526: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2025-02-07 04:51:28 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:63169: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.108.12
country_id: 1814991
description:
2025-02-07 04:51:55 dovecot_plain authenticator failed for ([112.27.108.12]) [112.27.108.12]:50603: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-07 04:51:46 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:50407: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
country_id: 2328926
description:
2025-02-07 04:51:53 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:44889: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
country_id: 3017382
description:
2025-02-07 04:51:20 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:52110: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.205
country_id: 1668284
description:
2025-02-07 04:51:30 dovecot_plain authenticator failed for 111-70-25-205.emome-ip.hinet.net [111.70.25.205]:40918: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.1.60
country_id: 1835841
description:
2025-02-07 04:51:30 dovecot_plain authenticator failed for ([175.206.1.60]) [175.206.1.60]:39787: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.163.57.10
country_id: 1643084
description:
2025-02-07 04:51:34 dovecot_plain authenticator failed for (ip-103-133.222-205.cloudteknologinusantara.co.id) [125.163.57.10]:60834: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
country_id: 6252001
description:
2025-02-07 04:51:35 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:59048: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
country_id: 1210997
description:
2025-02-07 04:51:45 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:48406: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2025-02-07 04:51:58 dovecot_plain authenticator failed for (www.safecleen.com) [58.49.113.138]:11160: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
country_id: 2661886
description:
2025-02-07 04:51:26 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:36828: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
country_id: 1814991
description:
2025-02-07 04:51:42 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:44709: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
country_id: 3469034
description:
2025-02-07 04:51:28 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:39270: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.192
country_id: 2017370
description:
2025-02-07 04:51:28 dovecot_plain authenticator failed for ([178.178.194.192]) [178.178.194.192]:43698: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
country_id: 3469034
description:
2025-02-07 04:51:30 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:38995: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.62
country_id: 2077456
description:
Feb  7 04:51:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
country_id: 290291
description:
2025-02-07 04:51:51 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:40862: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.94.190.203
country_id: 719819
description:
2025-02-07 04:52:42 dovecot_login authenticator failed for (ADMIN) [185.94.190.203]:5319: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
country_id: 1835841
description:
2025-02-07 04:53:54 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:38195: 535 Incorrect authentication data (set_id=oudoc)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-53.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
country_id: 1814991
description:
2025-02-07 04:53:53 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:51602: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.77.166.201
country_id: 3469034
description:
[2025-02-07 04:53:33 +0100] info [webmaild] 201.77.166.201 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
country_id: 1835841
description:
2025-02-07 04:53:40 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:53852: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 04:53:44 ait sshd[1597569]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 04:53:44 ait sshd[1597569]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
country_id: 2264397
description:
2025-02-07 04:54:01 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:49727: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2025-02-07 04:54:48 dovecot_plain authenticator failed for ([103.57.224.221]) [103.57.224.221]:50059: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.32.147
country_id: 3469034
description:
[2025-02-07 04:54:15 +0100] info [webmaild] 168.205.32.147 - info@gvu.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.151
country_id: 2017370
description:
2025-02-07 04:54:33 dovecot_plain authenticator failed for ([178.178.194.151]) [178.178.194.151]:35844: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.115.91
country_id: 1880251
description:
47.128.115.91 - - [07/Feb/2025:04:54:31 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16413274 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=586" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.115.91


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
country_id: 1814991
description:
2025-02-07 04:54:44 dovecot_plain authenticator failed for ([210.22.130.22]) [58.246.241.234]:46210: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
country_id: 2017370
description:
2025-02-07 04:54:20 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:52362: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
country_id: 2661886
description:
2025-02-07 04:54:28 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:51802: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.208.197
country_id: 1814991
description:
2025-02-07 04:54:34 dovecot_plain authenticator failed for ([111.48.208.197]) [111.48.208.197]:39668: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.142.78
country_id: 1814991
description:
2025-02-07 04:55:57 dovecot_login authenticator failed for ([222.174.142.78]) [222.174.142.78]:5949: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 31.24.159.135
country_id: 2510769
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:04-55.31.24.159.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
country_id: 2077456
description:
2025-02-07 04:55:49 dovecot_login authenticator failed for ([203.29.84.253]) [203.63.46.34]:63222: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2025-02-07 04:56:06 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:46782: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
country_id: 6252001
description:
2025-02-07 04:56:08 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:34358: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.248.26.21
country_id: 6252001
description:
2025-02-07 04:55:34 dovecot_login authenticator failed for syn-067-248-026-021.res.spectrum.com [67.248.26.21]:35788: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
country_id: 1269750
description:
2025-02-07 04:55:45 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:50449: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
country_id: 798544
description:
2025-02-07 04:56:18 dovecot_login authenticator failed for (user-static-94-254-244-211.mobile.play-internet.pl) [94.254.244.211]:42529: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
country_id: 1814991
description:
2025-02-07 04:56:21 dovecot_plain authenticator failed for ([223.100.248.64]) [223.100.248.64]:34444: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 04:56:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.61.207
country_id: 3469034
description:
[2025-02-07 04:58:16 +0100] info [webmaild] 45.164.61.207 - info@elma-hk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.51.17
country_id: 1880251
description:
47.128.51.17 - - [07/Feb/2025:04:59:00 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15963325 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?filter_course-language=120&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.51.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-07 04:59:08 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:57678: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
country_id: 1835841
description:
2025-02-07 05:00:07 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:48582: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.243.129.49
country_id: 3469034
description:
[2025-02-07 04:59:30 +0100] info [webmaild] 191.243.129.49 - info@ijari.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.241.234
country_id: 1814991
description:
2025-02-07 04:59:39 dovecot_plain authenticator failed for ([210.22.130.22]) [58.246.241.234]:51128: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2025-02-07 04:59:44 dovecot_plain authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:40190: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.18.255
country_id: 1880251
description:
47.128.18.255 - - [07/Feb/2025:04:59:50 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12574106 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/12/?filter_course-category=61&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.18.255


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2025-02-07 05:00:44 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:39462: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
country_id: 1814991
description:
2025-02-07 05:00:57 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:40600: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
country_id: 1814991
description:
2025-02-07 05:01:35 dovecot_plain authenticator failed for ([218.1.239.146]) [116.231.84.13]:47730: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.115.29
country_id: 6290252
description:
Feb  7 05:02:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.115.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
country_id: 1814991
description:
2025-02-07 05:02:08 dovecot_plain authenticator failed for (113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:44798: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
country_id: 1835841
description:
2025-02-07 05:01:17 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:58836: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.141.106
country_id: 290291
description:
2025-02-07 05:01:26 dovecot_login authenticator failed for ([87.236.141.106]) [87.236.141.106]:38857: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
country_id: 6252001
description:
2025-02-07 05:01:48 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:52231: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
country_id: 1814991
description:
2025-02-07 05:02:04 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:53934: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.115.29
country_id: 6290252
description:
2025-02-07 05:02:05 dovecot_login authenticator failed for (ADMIN) [37.46.115.29]:55680: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
country_id: 3469034
description:
2025-02-07 05:01:16 dovecot_login authenticator failed for ([179.252.107.105]) [177.6.235.62]:35644: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
country_id: 1814991
description:
2025-02-07 05:02:28 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:33810: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
country_id: 1149361
description:
2025-02-07 05:02:35 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:52745: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 05:02:12 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.191.170.208
country_id: 6252001
description:
2025-02-07 05:02:16 dovecot_plain authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:52498: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.42
country_id: 2921044
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:olanrewajutolu35@gmail.com||WPU:olanrewajutolu35@gmail.com||RSV:6.65||T:APACHE||MV:05-03.204.10.194.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.136.130
country_id: 1819730
description:
2025-02-07 05:04:01 dovecot_plain authenticator failed for 14-0-136-130.static.pccw-hkt.com [14.0.136.130]:39521: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
country_id: 6252001
description:
2025-02-07 05:04:04 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:50898: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 57.128.47.31
country_id: 3017382
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-04.57.128.47.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
country_id: 1880251
description:
2025-02-07 05:03:37 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:36246: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
country_id: 6252001
description:
2025-02-07 05:03:45 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:51418: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
country_id: 337996
description:
2025-02-07 05:04:24 dovecot_plain authenticator failed for ([196.189.124.229]) [196.189.124.229]:59818: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 05:04:27 ait sshd[1601182]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
country_id: 1168579
description:
2025-02-07 05:04:33 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:59537: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
country_id: 1814991
description:
2025-02-07 05:04:36 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:55154: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
country_id: 1814991
description:
2025-02-07 05:04:46 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:60800: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
country_id: 1819730
description:
2025-02-07 05:04:20 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:37520: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 38.62.224.40
country_id: 6252001
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:05-04.38.62.224.40


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 05:04:27 ait sshd[1601182]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
country_id: 1522867
description:
2025-02-07 05:04:35 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:46230: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.105.217
country_id: 1814991
description:
2025-02-07 05:05:32 dovecot_plain authenticator failed for ([163.179.105.217]) [163.179.105.217]:49010: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-02-07 05:05:20 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:51558: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.85.119
country_id: 1835841
description:
2025-02-07 05:05:25 dovecot_plain authenticator failed for ([211.216.85.119]) [211.216.85.119]:45004: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.98.135
country_id: 1835841
description:
2025-02-07 05:05:12 dovecot_plain authenticator failed for ([222.122.98.135]) [222.122.98.135]:51183: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
country_id: 2635167
description:
2025-02-07 05:06:30 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:24161: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.190.180.189
country_id: 1168579
description:
[2025-02-07 05:06:37 +0100] info [webmaild] 182.190.180.189 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
country_id: 1835841
description:
2025-02-07 05:06:17 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:34123: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
country_id: 3469034
description:
2025-02-07 05:06:25 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:48372: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.46.174
country_id: 1522867
description:
2025-02-07 05:06:44 dovecot_plain authenticator failed for ([92.47.46.174]) [92.47.46.174]:46054: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.180.58
country_id: 1835841
description:
2025-02-07 05:06:47 dovecot_plain authenticator failed for ([114.30.180.58]) [114.30.180.58]:33175: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
country_id: 6252001
description:
2025-02-07 05:07:06 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:43856: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
country_id: 6252001
description:
2025-02-07 05:06:56 dovecot_plain authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:60030: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
country_id: 3017382
description:
2025-02-07 05:07:24 dovecot_plain authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:35704: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
country_id: 1814991
description:
2025-02-07 05:07:14 dovecot_plain authenticator failed for ([202.200.15.1]) [202.200.14.2]:55553: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
country_id: 6252001
description:
2025-02-07 05:07:16 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:46173: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
country_id: 1831722
description:
2025-02-07 05:07:33 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:52070: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.1.10
country_id: 6252001
description:
2025-02-07 05:07:45 dovecot_plain authenticator failed for pool-100-37-1-10.nycmny.fios.verizon.net [100.37.1.10]:52682: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
country_id: 1269750
description:
2025-02-07 05:07:54 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:45772: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.44.78.243
country_id: 3374766
description:
2025-02-07 05:08:01 dovecot_plain authenticator failed for ([38.44.78.243]) [38.44.78.243]:36584: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
country_id: 1527747
description:
2025-02-07 05:07:10 dovecot_plain authenticator failed for ([77.235.25.35]) [77.235.25.35]:45411: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
country_id: 1819730
description:
2025-02-07 05:08:54 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:9107: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.40.16.26
country_id: 3175395
description:
2025-02-07 05:09:04 dovecot_login authenticator failed for net-2-40-16-26.cust.vodafonedsl.it [2.40.16.26]:40530: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
country_id: 1819730
description:
2025-02-07 05:08:12 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:52098: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.216.105.6
country_id: 6252001
description:
Feb  7 05:09:26 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.216.105.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.216.105.6
country_id: 6252001
description:
2025-02-07 05:09:28 dovecot_plain authenticator failed for ([127.0.0.1]) [91.216.105.6]:59850: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.168.243
country_id: 1814991
description:
Feb  7 05:10:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.168.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.168.243
country_id: 1814991
description:
2025-02-07 05:11:00 dovecot_plain authenticator failed for ([120.236.168.243]) [120.236.168.243]:49611: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
country_id: 3469034
description:
Feb  7 05:11:09 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
country_id: 6252001
description:
2025-02-07 05:10:59 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:45982: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2025-02-07 05:11:01 dovecot_plain authenticator failed for (nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:33040: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
country_id: 1814991
description:
2025-02-07 05:10:25 dovecot_plain authenticator failed for ([183.249.1.81]) [183.249.1.81]:60547: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.2.30
country_id: 3469034
description:
[2025-02-07 05:10:32 +0100] info [webmaild] 143.255.2.30 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
country_id: 1269750
description:
Feb  7 05:10:59 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.240
country_id: 798544
description:
2025-02-07 05:10:59 dovecot_login authenticator failed for (ADMIN) [138.199.59.240]:36688: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
country_id: 3469034
description:
2025-02-07 05:11:11 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:61349: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.154.134.146
country_id: 1814991
description:
Feb  7 05:11:16 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.154.134.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.154.134.146
country_id: 1814991
description:
2025-02-07 05:11:18 dovecot_plain authenticator failed for ([36.154.134.146]) [36.154.134.146]:42441: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
country_id: 1835841
description:
Feb  7 05:11:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
country_id: 1835841
description:
2025-02-07 05:11:54 dovecot_plain authenticator failed for ([211.199.5.231]) [211.199.5.231]:39374: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.252
country_id: 1835841
description:
Feb  7 05:12:03 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.252
country_id: 1835841
description:
2025-02-07 05:12:05 dovecot_login authenticator failed for ([211.247.127.252]) [211.247.127.252]:58684: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
country_id: 3469034
description:
Feb  7 05:12:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 48.218.170.53
country_id: 1861060
description:
2025-02-07 05:12:17 dovecot_login authenticator failed for ([48.218.170.53]) [48.218.170.53]:51690: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.63.70
country_id: 1835841
description:
2025-02-07 05:12:35 dovecot_plain authenticator failed for ([59.12.63.70]) [59.12.63.70]:42596: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
country_id: 1835841
description:
Feb  7 05:12:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2025-02-07 05:12:13 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:58250: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 48.218.170.53
country_id: 1861060
description:
Feb  7 05:12:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 48.218.170.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
country_id: 1835841
description:
Feb  7 05:12:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
country_id: 1835841
description:
2025-02-07 05:12:27 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:36652: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
country_id: 1835841
description:
2025-02-07 05:12:39 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:41370: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
country_id: 6252001
description:
2025-02-07 05:13:07 dovecot_login authenticator failed for (136-38-202-60.googlefiber.net) [136.38.202.60]:39513: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
country_id: 1835841
description:
Feb  7 05:12:11 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
country_id: 3469034
description:
2025-02-07 05:12:19 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:44878: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
country_id: 6252001
description:
Feb  7 05:13:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.63.70
country_id: 1835841
description:
Feb  7 05:12:33 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.63.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
country_id: 1819730
description:
Feb  7 05:12:44 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
country_id: 1819730
description:
2025-02-07 05:12:46 dovecot_login authenticator failed for (m121-202-197-86.smartone.com) [121.202.197.86]:65257: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 05:13:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.185.121
country_id: 99237
description:
Feb  7 05:13:39 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.185.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.185.121
country_id: 99237
description:
2025-02-07 05:13:41 dovecot_plain authenticator failed for (mishippus) [65.20.185.121]:42479: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.104
country_id: 1819730
description:
2025-02-07 05:14:17 dovecot_plain authenticator failed for (m121-202-152-104.smartone.com) [121.202.152.104]:8772: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
country_id: 1814991
description:
Feb  7 05:14:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
country_id: 1814991
description:
2025-02-07 05:14:36 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:35113: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Feb  7 05:14:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-02-07 05:14:54 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:54324: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.104
country_id: 1819730
description:
Feb  7 05:14:15 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.222.74
country_id: 1814991
description:
2025-02-07 05:15:36 dovecot_plain authenticator failed for ([218.15.222.74]) [218.15.222.74]:29555: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
country_id: 6252001
description:
2025-02-07 05:15:39 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:50146: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
country_id: 3932488
description:
Feb  7 05:15:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.174.142.78
country_id: 1814991
description:
Feb  7 05:15:28 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.174.142.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.174.142.78
country_id: 1814991
description:
2025-02-07 05:15:30 dovecot_plain authenticator failed for ([222.174.142.78]) [222.174.142.78]:41117: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.15.222.74
country_id: 1814991
description:
Feb  7 05:15:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.15.222.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
country_id: 6252001
description:
Feb  7 05:15:37 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-02-07 05:15:47 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:37466: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.229.244.195
country_id: 3469034
description:
[2025-02-07 05:15:29 +0100] info [webmaild] 200.229.244.195 - info@aitopen.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
country_id: 1835841
description:
Feb  7 05:16:17 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
country_id: 1814991
description:
Feb  7 05:16:32 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.138
country_id: 3077311
description:
2025-02-07 05:16:36 dovecot_login authenticator failed for (ADMIN) [212.102.39.138]:54282: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
country_id: 6252001
description:
Feb  7 05:16:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
country_id: 6252001
description:
2025-02-07 05:16:12 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:53436: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
country_id: 2017370
description:
Feb  7 05:16:25 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
country_id: 2017370
description:
2025-02-07 05:16:27 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:22489: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.237.247
country_id: 3469034
description:
[2025-02-07 05:16:48 +0100] info [webmaild] 138.118.237.247 - info@university-publishing.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.246
country_id: 1880251
description:
47.128.122.246 - - [07/Feb/2025:05:17:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11784299 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/10/?filter_course-category=61&filter_course-language=183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.246


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
country_id: 1835841
description:
2025-02-07 05:16:19 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:38040: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.138
country_id: 3077311
description:
Feb  7 05:16:34 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
country_id: 1814991
description:
2025-02-07 05:16:34 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:56599: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.40.123
country_id: 2017370
description:
Feb  7 05:17:30 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.40.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.40.123
country_id: 2017370
description:
2025-02-07 05:17:32 dovecot_plain authenticator failed for ([90.188.40.123]) [90.188.40.123]:38152: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
country_id: 1668284
description:
Feb  7 05:17:41 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
country_id: 1668284
description:
2025-02-07 05:17:43 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:48640: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 05:17:45 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
country_id: 1819730
description:
Feb  7 05:17:46 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
country_id: 1819730
description:
2025-02-07 05:17:48 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:41351: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
country_id: 1835841
description:
2025-02-07 05:19:07 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:39677: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
country_id: 1814991
description:
Feb  7 05:18:10 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
country_id: 1814991
description:
2025-02-07 05:18:12 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:33021: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.178.198.136
country_id: 1814991
description:
2025-02-07 05:18:51 dovecot_plain authenticator failed for ([117.178.198.136]) [117.178.198.136]:49728: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-07 05:19:06 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:48250: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.178.198.136
country_id: 1814991
description:
Feb  7 05:18:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.178.198.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  7 05:19:04 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
country_id: 1835841
description:
Feb  7 05:19:05 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
country_id: 798544
description:
2025-02-07 05:19:40 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:57000: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.125.146.242
country_id: 6252001
description:
Feb  7 05:19:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.125.146.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
country_id: 1835841
description:
Feb  7 05:19:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.166
country_id: 1814991
description:
Feb  7 05:19:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
country_id: 1814991
description:
Feb  7 05:19:18 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
country_id: 1835841
description:
Feb  7 05:19:43 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
country_id: 1269750
description:
2025-02-07 05:19:47 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:51946: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
country_id: 3017382
description:
Feb  7 05:19:49 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
country_id: 1269750
description:
Feb  7 05:19:52 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
country_id: 3175395
description:
2025-02-07 05:19:51 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:33434: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.94.206.187
country_id: 3469034
description:
Feb  7 05:19:58 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.94.206.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
country_id: 3469034
description:
2025-02-07 05:20:00 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:49016: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.151
country_id: 1814991
description:
Feb  7 05:19:13 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.106.187
country_id: 6252001
description:
2025-02-07 05:20:06 dovecot_plain authenticator failed for ([65.76.106.187]) [65.76.106.187]:52148: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.138.18
country_id: 3469034
description:
Feb  7 05:19:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.138.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
country_id: 1880251
description:
Feb  7 05:19:40 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
country_id: 1835841
description:
2025-02-07 05:19:45 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:42106: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 05:19:52 ait sshd[1606420]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
country_id: 1835841
description:
2025-02-07 05:19:14 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:34086: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
country_id: 3439705
description:
Feb  7 05:19:48 ait auth[1137145]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


