# incident

plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  4 17:42:45 ait sshd[62294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.44.120
description:
Feb  4 17:42:50 ait sshd[62323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.44.120  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  4 17:42:45 ait sshd[62294]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Feb  4 17:42:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-02-04 17:42:27 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:29127: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.148.197.119
description:
Feb  4 17:43:00 ait sshd[62365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.148.197.119  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-02-04 17:42:19 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:57210: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.254.57
description:
[2025-02-04 17:42:50 +0100] info [webmaild] 45.231.254.57 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.44.120
description:
Feb  4 17:42:50 ait sshd[62323]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.44.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.148.197.119
description:
Feb  4 17:43:00 ait sshd[62365]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.148.197.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.252.168.97
description:
Feb  4 17:43:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.252.168.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Feb  4 17:43:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.144.8.115
description:
Feb  4 17:43:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.144.8.115 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.65.245.126
description:
Feb  4 17:43:30 ait sshd[62810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.65.245.126  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.176.176
description:
[2025-02-04 17:43:34 +0100] info [webmaild] 177.131.176.176 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.123
description:
2025-02-04 17:43:43 dovecot_plain authenticator failed for (nsg-corporate-123.230.187.122.airtel.in) [122.187.230.123]:44220: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.4.12.44
description:
Feb  4 17:43:48 ait sshd[62959]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.4.12.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 17:43:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 17:43:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 17:43:28 dovecot_plain authenticator failed for ([211.109.75.67]) [211.109.75.69]:57157: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.4.12.44
description:
Feb  4 17:43:48 ait sshd[62959]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.4.12.44  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.63.214.213
description:
Feb  4 17:43:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.63.214.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-02-04 17:43:20 dovecot_plain authenticator failed for ([196.203.231.220]) [196.203.231.220]:51488: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.245.126
description:
Feb  4 17:43:30 ait sshd[62810]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.65.245.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.63.214.213
description:
2025-02-04 17:43:30 dovecot_plain authenticator failed for ([218.15.222.74]) [58.63.214.213]:19634: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.144.8.115
description:
2025-02-04 17:43:29 dovecot_plain authenticator failed for (cajasolidariaguachinango.com.mx) [201.144.8.115]:53213: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.123
description:
Feb  4 17:43:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.168.97
description:
2025-02-04 17:43:43 dovecot_plain authenticator failed for ([211.252.168.97]) [211.252.168.97]:33005: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.13.85.206
description:
[2025-02-04 17:44:09 +0100] info [webmaild] 200.13.85.206 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.122.43.155
description:
[2025-02-04 17:43:27 +0100] info [webmaild] 138.122.43.155 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.243.10
description:
Feb  4 17:44:32 ait sshd[63208]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.165.243.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.165.243.10
description:
Feb  4 17:44:32 ait sshd[63208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.165.243.10


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.82.26.182
description:
Feb  4 17:44:57 ait sshd[63294]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.82.26.182  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.36.108.223
description:
Feb  4 17:44:59 ait sshd[63307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.36.108.223


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.205.203.246
description:
Feb  4 17:44:47 ait sshd[63267]: pam_imunify(sshd:auth): [IM360_RBL] The IP 172.205.203.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 172.205.203.246
description:
Feb  4 17:44:47 ait sshd[63267]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.205.203.246  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.82.26.182
description:
Feb  4 17:44:57 ait sshd[63294]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.82.26.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Feb  4 17:44:59 ait sshd[63307]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.95.150.16
description:
Feb  4 17:45:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.95.150.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
description:
Feb  4 17:45:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.22.59
description:
[2025-02-04 17:45:36 +0100] info [webmaild] 131.255.22.59 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-02-04 17:46:02 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net [85.69.178.104]:52474: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-04 17:46:02 dovecot_plain authenticator failed for ([177.174.85.129]) [177.174.85.137]:48141: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.48.98.125
description:
Feb  4 17:45:17 ait sshd[63526]: pam_imunify(sshd:auth): [IM360_RBL] The IP 120.48.98.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-02-04 17:45:17 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:40136: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
description:
Feb  4 17:45:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Feb  4 17:45:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-02-04 17:45:45 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:2593: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Feb  4 17:45:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
description:
Feb  4 17:45:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-02-04 17:45:32 dovecot_plain authenticator failed for ([116.114.94.242]) [116.114.94.242]:48952: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.132.207
description:
2025-02-04 17:45:27 dovecot_plain authenticator failed for 207.132.220.111.sta.wbroadband.net.au [111.220.132.207]:45529: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 17:46:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-02-04 17:45:13 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:58129: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-02-04 17:45:15 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:53803: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
description:
2025-02-04 17:45:20 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:45144: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Feb  4 17:45:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
description:
2025-02-04 17:45:33 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:57931: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Feb  4 17:46:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Feb  4 17:45:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
description:
2025-02-04 17:45:29 dovecot_plain authenticator failed for ([182.163.122.133]) [182.163.122.133]:30309: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.98.125
description:
Feb  4 17:45:17 ait sshd[63526]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.98.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.132.207
description:
Feb  4 17:45:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.132.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.150.16
description:
2025-02-04 17:45:42 dovecot_plain authenticator failed for syn-070-095-150-016.res.spectrum.com [70.95.150.16]:57133: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  4 17:46:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Feb  4 17:45:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
description:
2025-02-04 17:46:23 dovecot_plain authenticator failed for ([170.233.29.157]) [170.233.29.157]:50990: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.194.116
description:
Feb  4 17:46:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.194.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-02-04 17:46:41 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:19001: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
description:
2025-02-04 17:46:44 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:55499: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Feb  4 17:46:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.65.203.82
description:
Feb  4 17:46:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.65.203.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  4 17:46:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.115.191.84
description:
Feb  4 17:46:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.115.191.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Feb  4 17:46:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-02-04 17:46:23 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:58132: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
description:
2025-02-04 17:46:19 dovecot_plain authenticator failed for ([113.193.187.154]) [113.193.187.154]:34670: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.196.240
description:
2025-02-04 17:46:20 dovecot_plain authenticator failed for (mobile-166-195-196-240.mycingular.net) [166.195.196.240]:57068: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
description:
2025-02-04 17:46:21 dovecot_plain authenticator failed for ([121.202.138.181]) [121.202.138.181]:52852: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
description:
Feb  4 17:47:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.240.240.253
description:
[2025-02-04 17:46:13 +0100] info [webmaild] 197.240.240.253 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.196.240
description:
Feb  4 17:46:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.196.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.194.116
description:
2025-02-04 17:46:38 dovecot_plain authenticator failed for ([120.234.194.116]) [120.234.194.116]:41912: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.23.193.5
description:
[2025-02-04 17:46:40 +0100] info [webmaild] 187.23.193.5 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.164.165
description:
Feb  4 17:46:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.164.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-02-04 17:47:10 dovecot_plain authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:47110: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.65.203.82
description:
2025-02-04 17:46:20 dovecot_plain authenticator failed for ([63.65.203.82]) [63.65.203.82]:60931: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-02-04 17:46:21 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:54211: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  4 17:46:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Feb  4 17:46:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-02-04 17:46:44 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:31662: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Feb  4 17:47:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Feb  4 17:46:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Feb  4 17:46:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-02-04 17:46:20 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:23260: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-02-04 17:46:30 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:49590: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Feb  4 17:46:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-02-04 17:46:45 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:39260: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 155.4.52.43
description:
Feb  4 17:46:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 155.4.52.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.248.178.230
description:
Feb  4 17:46:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.248.178.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-02-04 17:46:17 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:38822: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-02-04 17:46:21 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:59567: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
description:
Feb  4 17:46:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
description:
2025-02-04 17:46:36 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:48053: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Feb  4 17:46:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Feb  4 17:46:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.203.77.30
description:
Feb  4 17:46:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.203.77.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.84.132.142
description:
2025-02-04 17:46:34 dovecot_plain authenticator failed for ([41.84.132.142]) [41.84.132.142]:39981: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Feb  4 17:46:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
description:
2025-02-04 17:46:52 dovecot_plain authenticator failed for ([47.206.63.169]) [47.206.63.169]:58512: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.171.177
description:
2025-02-04 17:46:55 dovecot_plain authenticator failed for ([61.80.171.177]) [61.80.171.177]:58609: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.173.78.90
description:
Feb  4 17:46:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.173.78.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  4 17:46:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-02-04 17:46:32 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:43474: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Feb  4 17:46:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.182.119.202
description:
2025-02-04 17:46:27 dovecot_plain authenticator failed for ([45.182.119.202]) [45.182.119.202]:41730: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
description:
Feb  4 17:46:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.76.161.99
description:
Feb  4 17:46:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.76.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Feb  4 17:46:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
description:
Feb  4 17:46:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-02-04 17:47:05 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:55798: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.187.154
description:
Feb  4 17:46:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.187.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.56.11.148
description:
2025-02-04 17:46:23 dovecot_plain authenticator failed for 93-56-11-148.ip287.fastwebnet.it [93.56.11.148]:43171: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.253.226
description:
Feb  4 17:46:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.253.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-02-04 17:46:35 dovecot_plain authenticator failed for ([41.93.113.138]) [41.93.113.138]:51220: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.245.243.163
description:
Feb  4 17:46:37 ait sshd[64266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.245.243.163


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.248.178.230
description:
2025-02-04 17:46:19 dovecot_plain authenticator failed for 60-248-178-230.hinet-ip.hinet.net [60.248.178.230]:36760: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-02-04 17:46:24 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:49216: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-02-04 17:46:17 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:44076: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.122.115.9
description:
Feb  4 17:46:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.122.115.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Feb  4 17:46:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-02-04 17:46:22 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:55529: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.151.131.211
description:
Feb  4 17:46:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.151.131.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
description:
2025-02-04 17:46:28 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:42853: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.243.163
description:
Feb  4 17:46:37 ait sshd[64266]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.245.243.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Feb  4 17:46:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Feb  4 17:46:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
description:
2025-02-04 17:46:22 dovecot_plain authenticator failed for ([180.142.105.18]) [180.142.105.18]:52533: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.132.206
description:
Feb  4 17:46:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.132.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Feb  4 17:46:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-02-04 17:46:33 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:47300: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-02-04 17:46:33 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:40783: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
description:
2025-02-04 17:47:02 dovecot_plain authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:46564: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-02-04 17:46:15 dovecot_plain authenticator failed for ([119.206.117.105]) [119.206.117.105]:55220: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Feb  4 17:46:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Feb  4 17:46:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-04 17:46:36 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:40700: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Feb  4 17:46:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.40
description:
Feb  4 17:46:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Feb  4 17:46:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-02-04 17:46:44 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:60897: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Feb  4 17:46:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Feb  4 17:46:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
description:
Feb  4 17:46:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.40
description:
2025-02-04 17:46:36 dovecot_plain authenticator failed for (m121-202-197-40.smartone.com) [121.202.197.40]:8627: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-02-04 17:46:42 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:36674: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.80.171.177
description:
Feb  4 17:46:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.80.171.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-02-04 17:46:19 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:59406: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.56.11.148
description:
Feb  4 17:46:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.56.11.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Feb  4 17:46:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.110.210
description:
Feb  4 17:46:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Feb  4 17:46:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.122.115.9
description:
2025-02-04 17:46:22 dovecot_plain authenticator failed for ([220.122.115.9]) [220.122.115.9]:57302: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.207.82
description:
2025-02-04 17:46:24 dovecot_plain authenticator failed for ([182.90.207.82]) [182.90.207.82]:55932: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.76.161.99
description:
2025-02-04 17:46:33 dovecot_plain authenticator failed for ([89.211.42.163]) [80.76.161.99]:59599: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-02-04 17:46:35 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl [188.127.16.197]:57630: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-02-04 17:46:52 dovecot_plain authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:47748: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.132.206
description:
2025-02-04 17:46:32 dovecot_plain authenticator failed for ([222.68.132.206]) [222.68.132.206]:43443: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.253.125.205
description:
2025-02-04 17:46:37 dovecot_plain authenticator failed for ([183.253.125.205]) [183.253.125.205]:36248: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.164.165
description:
2025-02-04 17:46:45 dovecot_plain authenticator failed for ([5.11.164.165]) [5.11.164.165]:46303: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.52.43
description:
2025-02-04 17:46:52 dovecot_plain authenticator failed for h-155-4-52-43.a213.priv.bahnhof.se [155.4.52.43]:42706: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-04 17:46:19 dovecot_plain authenticator failed for (200-232-71-201.mdanet.com.br) [189.108.147.210]:60441: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-02-04 17:46:28 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:53673: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
description:
Feb  4 17:46:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.98
description:
Feb  4 17:47:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.192.17
description:
Feb  4 17:47:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.192.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
description:
2025-02-04 17:46:18 dovecot_plain authenticator failed for ([90.173.78.90]) [90.173.78.90]:45332: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.138.181
description:
Feb  4 17:46:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.138.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.26.153.84
description:
Feb  4 17:46:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.26.153.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.26.153.84
description:
2025-02-04 17:46:27 dovecot_plain authenticator failed for ([118.26.153.84]) [118.26.153.84]:28468: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
description:
2025-02-04 17:46:35 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:32833: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
description:
2025-02-04 17:46:39 dovecot_plain authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:40422: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Feb  4 17:46:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.142.105.18
description:
Feb  4 17:46:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.142.105.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
description:
2025-02-04 17:46:34 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:60710: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-02-04 17:46:37 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:60560: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.110.210
description:
2025-02-04 17:46:42 dovecot_plain authenticator failed for ([222.190.110.210]) [222.190.110.210]:41376: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-02-04 17:46:45 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:61237: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.218.200
description:
Feb  4 17:46:50 ait sshd[64314]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.218.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.119.202
description:
Feb  4 17:46:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.119.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
description:
Feb  4 17:46:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Feb  4 17:46:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Feb  4 17:46:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Feb  4 17:46:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 163.179.124.31
description:
Feb  4 17:46:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 163.179.124.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.191.84
description:
2025-02-04 17:46:46 dovecot_plain authenticator failed for ([211.115.191.84]) [211.115.191.84]:55788: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
description:
Feb  4 17:46:19 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.90.207.82
description:
Feb  4 17:46:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.90.207.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
description:
2025-02-04 17:46:32 dovecot_plain authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:57458: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
description:
Feb  4 17:46:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
description:
Feb  4 17:46:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-02-04 17:46:40 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:55480: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-02-04 17:46:48 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:46118: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Feb  4 17:46:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
description:
Feb  4 17:46:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
description:
2025-02-04 17:46:34 dovecot_plain authenticator failed for ([61.184.119.61]) [61.184.119.61]:54928: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
description:
2025-02-04 17:46:35 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:46642: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.112.45.222
description:
Feb  4 17:46:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.112.45.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-02-04 17:46:44 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:45929: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Feb  4 17:46:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-02-04 17:46:33 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:37005: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.218.200
description:
Feb  4 17:46:50 ait sshd[64314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.218.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-02-04 17:46:17 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:53125: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.253.226
description:
2025-02-04 17:46:31 dovecot_plain authenticator failed for (abts-kk-static-226.253.166.122.airtelbroadband.in) [122.166.253.226]:35946: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.239.146
description:
2025-02-04 17:46:27 dovecot_plain authenticator failed for ([116.231.84.13]) [218.1.239.146]:2162: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-02-04 17:46:28 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:51702: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
description:
2025-02-04 17:46:31 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:21045: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Feb  4 17:46:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.233.29.157
description:
Feb  4 17:46:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.233.29.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.239.146
description:
Feb  4 17:46:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.239.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.192.17
description:
2025-02-04 17:47:08 dovecot_plain authenticator failed for ([191.59.192.17]) [191.59.192.17]:33632: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.203.77.30
description:
2025-02-04 17:46:19 dovecot_plain authenticator failed for ([50.203.77.30]) [50.203.77.30]:41364: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.179.124.31
description:
2025-02-04 17:46:43 dovecot_plain authenticator failed for ([163.179.124.31]) [163.179.124.31]:60114: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Feb  4 17:46:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Feb  4 17:46:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-02-04 17:46:26 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:54190: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.31
description:
2025-02-04 17:46:38 dovecot_plain authenticator failed for (m121-202-200-31.smartone.com) [121.202.200.31]:53468: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-02-04 17:46:35 dovecot_plain authenticator failed for ([211.105.223.49]) [211.105.223.49]:49864: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.253.125.205
description:
Feb  4 17:46:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.253.125.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.31
description:
Feb  4 17:46:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Feb  4 17:47:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-02-04 17:47:42 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:38610: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.29.235.66
description:
Feb  4 17:47:58 ait sshd[64752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.29.235.66


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Feb  4 17:47:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.210.232
description:
Feb  4 17:47:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.210.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-02-04 17:47:27 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:43543: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.29.235.66
description:
Feb  4 17:47:58 ait sshd[64752]: pam_imunify(sshd:auth): [IM360_RBL] The IP 202.29.235.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.73
description:
Feb  4 17:48:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.73
description:
2025-02-04 17:48:04 dovecot_plain authenticator failed for (m121-202-155-73.smartone.com) [121.202.155.73]:28137: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.167.81.237
description:
[2025-02-04 17:47:11 +0100] info [webmaild] 79.167.81.237 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-02-04 17:47:17 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:57534: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.82.18
description:
Feb  4 17:48:31 ait sshd[65167]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.213.82.18 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 67.213.82.18
description:
Feb  4 17:48:31 ait sshd[65167]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.213.82.18  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.169.113
description:
Feb  4 17:48:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.169.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.85.137
description:
2025-02-04 17:48:53 dovecot_plain authenticator failed for ([177.174.85.129]) [177.174.85.137]:40665: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-02-04 17:48:58 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:44676: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.38.78
description:
Feb  4 17:48:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.38.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-02-04 17:48:50 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:31884: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.85.137
description:
Feb  4 17:48:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.85.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Feb  4 17:48:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Feb  4 17:48:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-02-04 17:48:57 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:45714: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.68.38.78
description:
2025-02-04 17:48:13 dovecot_plain authenticator failed for ([103.68.38.78]) [103.68.38.78]:59388: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.76.50.228
description:
[2025-02-04 17:48:26 +0100] info [webmaild] 80.76.50.228 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Feb  4 17:48:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Feb  4 17:48:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Feb  4 17:48:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.236.162.125
description:
Feb  4 17:48:43 ait sshd[65192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.162.125


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.253.145.144
description:
[2025-02-04 17:49:05 +0100] info [webmaild] 38.253.145.144 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-02-04 17:48:40 dovecot_plain authenticator failed for 95-87-225-236.ip.btc-net.bg (95-87-225-236.net1.bg) [95.87.225.236]:52650: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
description:
2025-02-04 17:48:40 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:48505: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-02-04 17:48:42 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:57101: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Feb  4 17:49:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-02-04 17:49:54 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:58905: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
description:
Feb  4 17:50:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.188.109.140
description:
[2025-02-04 17:49:20 +0100] info [webmaild] 177.188.109.140 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.9.44.70
description:
[2025-02-04 17:49:51 +0100] info [webmaild] 185.9.44.70 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.114.61.50
description:
Feb  4 17:49:51 ait sshd[65505]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.114.61.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
description:
2025-02-04 17:50:11 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:55794: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-02-04 17:49:15 dovecot_plain authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:51560: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.173.49
description:
Feb  4 17:49:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.173.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Feb  4 17:49:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 17:49:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.68.180
description:
Feb  4 17:49:58 ait sshd[65540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.68.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Feb  4 17:50:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-02-04 17:50:05 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:59379: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-02-04 17:49:18 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:57853: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.173.49
description:
2025-02-04 17:49:27 dovecot_plain authenticator failed for (106.107.173.49.adsl.dynamic.seed.net.tw) [106.107.173.49]:11002: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.114.61.50
description:
Feb  4 17:49:51 ait sshd[65505]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.114.61.50  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-02-04 17:49:52 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:60975: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.68.180
description:
Feb  4 17:49:58 ait sshd[65540]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.68.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.127.195
description:
Feb  4 17:50:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.127.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Feb  4 17:49:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Feb  4 17:49:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Feb  4 17:50:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-02-04 17:50:39 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:49351: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.115.138.33
description:
[2025-02-04 17:51:05 +0100] info [webmaild] 196.115.138.33 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.127.195
description:
2025-02-04 17:50:12 dovecot_plain authenticator failed for ([39.164.127.195]) [39.164.127.195]:52022: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.172.46.10
description:
Feb  4 17:51:55 ait sshd[66410]: pam_imunify(sshd:auth): [IM360_RBL] The IP 107.172.46.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 107.172.46.10
description:
Feb  4 17:51:55 ait sshd[66410]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=107.172.46.10


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.217.229
description:
Feb  4 17:52:08 ait sshd[66461]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.217.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.16.85.102
description:
Feb  4 17:51:39 ait sshd[66347]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.16.85.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.16.85.102
description:
Feb  4 17:51:39 ait sshd[66347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.16.85.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.196.73.229
description:
[2025-02-04 17:51:44 +0100] info [webmaild] 181.196.73.229 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-51.118.67.214.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.17.127.3
description:
[2025-02-04 17:51:57 +0100] info [webmaild] 46.17.127.3 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.217.229
description:
Feb  4 17:52:08 ait sshd[66461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.217.229


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.37.89.177
description:
Feb  4 17:52:45 ait sshd[66713]: pam_imunify(sshd:auth): [IM360_RBL] The IP 70.37.89.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 70.37.89.177
description:
Feb  4 17:52:45 ait sshd[66713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=70.37.89.177  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 17:52:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.223.100.54
description:
[2025-02-04 17:52:32 +0100] info [webmaild] 31.223.100.54 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:17-53.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.196.221.74
description:
2025-02-04 17:53:44 dovecot_plain authenticator failed for ([159.196.221.74]) [159.196.221.74]:4086: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.6.89.244
description:
[2025-02-04 17:53:52 +0100] info [webmaild] 200.6.89.244 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
description:
2025-02-04 17:53:55 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:52786: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.71.17
description:
Feb  4 17:55:04 ait sshd[67786]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.71.17
description:
Feb  4 17:55:04 ait sshd[67786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.71.17


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.39.191.14
description:
Feb  4 17:54:15 ait sshd[67349]: pam_imunify(sshd:auth): [IM360_RBL] The IP 54.39.191.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 54.39.191.14
description:
Feb  4 17:54:15 ait sshd[67349]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.39.191.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.84.219
description:
[2025-02-04 17:54:30 +0100] info [webmaild] 84.54.84.219 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
description:
Feb  4 17:54:16 ait sshd[67352]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
description:
Feb  4 17:54:16 ait sshd[67352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 17:55:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Feb  4 17:55:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-02-04 17:55:44 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:37494: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
description:
Feb  4 17:55:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-02-04 17:56:03 dovecot_plain authenticator failed for ([27.223.100.92]) [27.223.100.90]:57684: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.11.78
description:
Feb  4 17:56:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.11.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.59.111.163
description:
[2025-02-04 17:55:15 +0100] info [webmaild] 189.59.111.163 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.252.96
description:
2025-02-04 17:55:59 dovecot_plain authenticator failed for p96096-obmd01.tokyo.ocn.ne.jp [124.101.252.96]:36004: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
description:
Feb  4 17:55:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.118
description:
2025-02-04 17:55:38 dovecot_plain authenticator failed for ([103.163.44.118]) [103.163.44.118]:46668: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.53.126.112
description:
Feb  4 17:55:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.53.126.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.220.155
description:
Feb  4 17:55:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-02-04 17:55:53 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:57484: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-02-04 17:55:54 dovecot_plain authenticator failed for (187-50-84-19.customer.tdatabrasil.net.br) [177.43.106.73]:47937: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.252.96
description:
Feb  4 17:55:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.252.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.163.44.118
description:
Feb  4 17:55:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.163.44.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.37.145
description:
Feb  4 17:55:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.37.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.173.16.21
description:
Feb  4 17:55:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.173.16.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
description:
2025-02-04 17:55:39 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:60776: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-02-04 17:55:44 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:48554: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Feb  4 17:55:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.57.71
description:
Feb  4 17:56:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.57.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Feb  4 17:55:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.149.186.106
description:
[2025-02-04 17:55:46 +0100] info [webmaild] 103.149.186.106 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Feb  4 17:55:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Feb  4 17:56:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.165.200
description:
Feb  4 17:56:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.165.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.13.243.101
description:
2025-02-04 17:55:39 dovecot_plain authenticator failed for bl3-243-101.dsl.telepac.pt [213.13.243.101]:3086: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.196.97
description:
Feb  4 17:55:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.196.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
description:
2025-02-04 17:55:55 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:58692: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.100.90
description:
Feb  4 17:56:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-02-04 17:56:04 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:42060: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.65.24
description:
Feb  4 17:55:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.65.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  4 17:55:32 ait sshd[67981]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.13.243.101
description:
Feb  4 17:55:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.13.243.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Feb  4 17:55:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-02-04 17:55:40 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:34551: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 17:55:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.37.145
description:
2025-02-04 17:55:58 dovecot_plain authenticator failed for (145.37.212.118.adsl-pool.jx.chinaunicom.com) [118.212.37.145]:35089: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  4 17:55:18 ait sshd[67939]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Feb  4 17:55:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-02-04 17:55:43 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:4527: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.7.163
description:
2025-02-04 17:55:38 dovecot_plain authenticator failed for 61-216-7-163.hinet-ip.hinet.net (61-216-7-164.hinet-ip.hinet.net) [61.216.7.163]:38224: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.216.7.163
description:
Feb  4 17:55:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.216.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Feb  4 17:55:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.196.97
description:
2025-02-04 17:55:43 dovecot_plain authenticator failed for ([45.181.196.97]) [45.181.196.97]:35276: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Feb  4 17:55:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
description:
2025-02-04 17:55:54 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:62756: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.78
description:
2025-02-04 17:56:06 dovecot_plain authenticator failed for 111-70-11-78.emome-ip.hinet.net [111.70.11.78]:41708: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.57.71
description:
2025-02-04 17:56:10 dovecot_plain authenticator failed for n220246057071.netvigator.com [220.246.57.71]:60973: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-04 17:55:15 dovecot_plain authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:43671: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Feb  4 17:55:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-02-04 17:55:34 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:54576: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-02-04 17:55:36 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:48375: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-02-04 17:55:36 dovecot_plain authenticator failed for ([196.216.81.126]) [196.216.81.126]:34454: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.132.61.213
description:
2025-02-04 17:55:51 dovecot_plain authenticator failed for ([124.132.61.213]) [124.132.61.213]:36124: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Feb  4 17:55:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.67.5.146
description:
2025-02-04 17:55:52 dovecot_plain authenticator failed for ([183.67.5.146]) [183.67.5.146]:54439: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Feb  4 17:55:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-02-04 17:55:57 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:55595: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  4 17:55:32 ait sshd[67981]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.68.71
description:
Feb  4 17:55:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.68.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.208.4
description:
2025-02-04 17:55:36 dovecot_plain authenticator failed for ([103.81.208.4]) [103.81.208.4]:56708: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Feb  4 17:55:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-02-04 17:55:42 dovecot_plain authenticator failed for ([103.109.44.163]) [122.165.137.159]:51090: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.173.16.21
description:
2025-02-04 17:55:51 dovecot_plain authenticator failed for (201.173.16.21-clientes-izzi.mx) [201.173.16.21]:43295: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Feb  4 17:55:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
description:
2025-02-04 17:56:06 dovecot_plain authenticator failed for ([82.102.165.200]) [82.102.165.200]:33604: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.132.61.213
description:
Feb  4 17:55:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.132.61.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Feb  4 17:55:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
description:
2025-02-04 17:55:48 dovecot_plain authenticator failed for (undefined.hostname.localhost) [103.90.97.98]:46036: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.67.5.146
description:
Feb  4 17:55:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.67.5.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.220.155
description:
2025-02-04 17:55:54 dovecot_plain authenticator failed for ([5.142.220.155]) [5.142.220.155]:55815: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.208.4
description:
Feb  4 17:55:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.208.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.68.71
description:
2025-02-04 17:55:38 dovecot_plain authenticator failed for ([220.85.68.71]) [220.85.68.71]:2243: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-02-04 17:55:40 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:53722: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.53.126.112
description:
2025-02-04 17:55:49 dovecot_plain authenticator failed for ([14.53.126.112]) [14.53.126.112]:51992: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  4 17:55:18 ait sshd[67939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  4 17:56:53 ait sshd[68485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.173.175.140
description:
[2025-02-04 17:57:10 +0100] info [webmaild] 103.173.175.140 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
description:
2025-02-04 17:56:13 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:64059: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  4 17:56:53 ait sshd[68485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 142.4.1.40
description:
Feb  4 17:56:23 ait sshd[68287]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=142.4.1.40  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.29.224.4
description:
[2025-02-04 17:56:33 +0100] info [webmaild] 5.29.224.4 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Feb  4 17:56:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.1.40
description:
Feb  4 17:56:23 ait sshd[68287]: pam_imunify(sshd:auth): [IM360_RBL] The IP 142.4.1.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.68.37.25
description:
2025-02-04 17:57:58 dovecot_plain authenticator failed for 78-68-37-25-no2560.tbcn.telia.com (undenic) [78.68.37.25]:32793: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
description:
Feb  4 17:58:05 ait sshd[69014]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
description:
Feb  4 17:58:05 ait sshd[69014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.68.37.25
description:
Feb  4 17:57:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.68.37.25 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.121.81.189
description:
[2025-02-04 17:59:09 +0100] info [webmaild] 196.121.81.189 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.149.143
description:
[2025-02-04 17:58:23 +0100] info [webmaild] 187.19.149.143 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
description:
Feb  4 17:58:44 ait sshd[69490]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
description:
Feb  4 17:58:44 ait sshd[69490]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Feb  4 17:59:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
description:
Feb  4 17:59:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-04 17:59:57 dovecot_plain authenticator failed for (fochess) [207.188.157.230]:43900: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-02-04 17:59:23 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:37314: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.123.172.255
description:
[2025-02-04 17:59:44 +0100] info [webmaild] 94.123.172.255 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-02-04 17:59:51 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:41682: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  4 17:59:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-02-04 18:00:16 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:32952: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.93.242.174
description:
[2025-02-04 18:00:21 +0100] info [webmaild] 177.93.242.174 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.29.104.32
description:
Feb  4 18:00:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.29.104.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.29.104.32
description:
2025-02-04 18:00:25 dovecot_plain authenticator failed for 32.104.29.34.bc.googleusercontent.com [34.29.104.32]:48280: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Feb  4 18:00:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.106.50.225
description:
[2025-02-04 18:01:12 +0100] info [webmaild] 193.106.50.225 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.72.125.16
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:18-01.94.72.125.16


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.177.177.219
description:
[2025-02-04 18:01:43 +0100] info [webmaild] 191.177.177.219 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 18:01:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.248
description:
Feb  4 18:02:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
description:
Feb  4 18:02:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 27.109.113.70
domain: iric.us
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/local/moodle_webshell/webshell.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.238.11
description:
[2025-02-04 18:03:03 +0100] info [webmaild] 138.118.238.11 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.43.219
description:
[2025-02-04 18:02:33 +0100] info [webmaild] 91.106.43.219 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.248
description:
2025-02-04 18:02:32 dovecot_plain authenticator failed for 111-70-23-248.emome-ip.hinet.net [111.70.23.248]:34006: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
description:
2025-02-04 18:02:17 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:56326: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
description:
Feb  4 18:04:09 ait sshd[71798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Feb  4 18:03:11 ait sshd[71238]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Feb  4 18:03:11 ait sshd[71238]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.221.223.159
description:
Feb  4 18:03:17 ait sshd[71280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.221.223.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.18
description:
Feb  4 18:03:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.18
description:
2025-02-04 18:03:20 dovecot_plain authenticator failed for ([125.90.72.18]) [125.90.72.18]:58610: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Feb  4 18:03:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-02-04 18:03:36 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:56367: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
description:
Feb  4 18:04:09 ait sshd[71798]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.190.75
description:
[2025-02-04 18:03:58 +0100] info [webmaild] 177.36.190.75 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 18:04:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-04.118.67.214.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.163.2.111
description:
[2025-02-04 18:04:31 +0100] info [webmaild] 194.163.2.111 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-04 18:05:53 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (fleced) [91.56.31.167]:63151: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Feb  4 18:06:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.219
description:
[2025-02-04 18:05:18 +0100] info [webmaild] 213.230.86.219 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.64.175
description:
[2025-02-04 18:05:56 +0100] info [webmaild] 169.224.64.175 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 18:05:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  4 18:05:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.5.199.17
description:
[2025-02-04 18:06:47 +0100] info [webmaild] 191.5.199.17 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.38.136.162
description:
Feb  4 18:06:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.38.136.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.171.21.192
description:
Feb  4 18:07:06 ait sshd[73069]: pam_imunify(sshd:auth): [IM360_RBL] The IP 203.171.21.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 203.171.21.192
description:
Feb  4 18:07:06 ait sshd[73069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=203.171.21.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.174.90
description:
Feb  4 18:06:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.174.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.174.90
description:
2025-02-04 18:06:22 dovecot_plain authenticator failed for ([58.34.174.90]) [58.34.174.90]:33060: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.231.6
description:
2025-02-04 18:07:02 dovecot_plain authenticator failed for ([60.174.231.6]) [60.174.231.6]:39469: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
description:
Feb  4 18:06:22 ait sshd[72777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
description:
Feb  4 18:06:22 ait sshd[72777]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.38.136.162
description:
2025-02-04 18:06:50 dovecot_plain authenticator failed for syn-047-038-136-162.res.spectrum.com [47.38.136.162]:49646: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.231.6
description:
Feb  4 18:07:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.231.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-02-04 18:06:11 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:60926: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.221.101.111
description:
Feb  4 18:07:44 ait sshd[73325]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.221.101.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-02-04 18:07:55 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:64804: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.50.26
description:
[2025-02-04 18:07:18 +0100] info [webmaild] 128.201.50.26 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Feb  4 18:07:34 ait sshd[73280]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Feb  4 18:07:34 ait sshd[73280]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-02-04 18:07:37 dovecot_plain authenticator failed for ([116.114.94.242]) [116.114.94.242]:37938: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.221.101.111
description:
Feb  4 18:07:44 ait sshd[73325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.221.101.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Feb  4 18:07:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Feb  4 18:07:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.33.120.170
description:
[2025-02-04 18:08:10 +0100] info [webmaild] 212.33.120.170 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.193
description:
[2025-02-04 18:08:48 +0100] info [webmaild] 84.54.73.193 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 18:09:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.229.118.208
description:
Feb  4 18:09:07 ait sshd[74008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.118.208


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.244.88
description:
Feb  4 18:08:20 ait sshd[73591]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.101.244.88 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.101.244.88
description:
Feb  4 18:08:20 ait sshd[73591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.101.244.88  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Feb  4 18:10:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.110.77
description:
Feb  4 18:09:47 ait sshd[74184]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.110.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.110.77
description:
Feb  4 18:09:47 ait sshd[74184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.110.77


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.213.57.49
description:
2025-02-04 18:10:01 dovecot_plain authenticator failed for ([182.213.57.49]) [182.213.57.49]:48835: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 94.228.126.38
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-09.94.228.126.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.147.231
description:
Feb  4 18:10:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.147.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-02-04 18:10:07 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:39888: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.182.139.37
description:
[2025-02-04 18:09:32 +0100] info [webmaild] 177.182.139.37 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.213.57.49
description:
Feb  4 18:09:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.213.57.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.147.231
description:
2025-02-04 18:10:03 dovecot_plain authenticator failed for ([191.59.147.231]) [191.59.147.231]:53982: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.205.1.110
description:
[2025-02-04 18:10:04 +0100] info [webmaild] 191.205.1.110 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
description:
2025-02-04 18:11:10 dovecot_plain authenticator failed for 111-70-29-158.emome-ip.hinet.net [111.70.29.158]:54292: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.113.101
description:
Feb  4 18:10:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.113.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.140.240
description:
Feb  4 18:10:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.140.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.123.153.214
description:
Feb  4 18:11:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.123.153.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.123.153.214
description:
2025-02-04 18:11:09 dovecot_plain authenticator failed for ([144.123.153.214]) [144.123.153.214]:54622: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.41
description:
Feb  4 18:10:26 ait sshd[74597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.41  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-02-04 18:10:30 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:55032: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.4.133
description:
2025-02-04 18:11:00 dovecot_plain authenticator failed for 89-109-4-133.dynamic.mts-nn.ru [89.109.4.133]:49753: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.100.235.17
description:
[2025-02-04 18:11:08 +0100] info [webmaild] 103.100.235.17 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.113.101
description:
2025-02-04 18:10:19 dovecot_plain authenticator failed for ([211.48.113.101]) [211.48.113.101]:51054: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.140.240
description:
2025-02-04 18:10:22 dovecot_plain authenticator failed for ([111.48.140.240]) [111.48.140.240]:30248: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.41
description:
Feb  4 18:10:26 ait sshd[74597]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Feb  4 18:10:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.4.133
description:
Feb  4 18:10:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.4.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.29.158
description:
Feb  4 18:11:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.29.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.81
description:
2025-02-04 18:11:16 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.81]:47669: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-02-04 18:11:34 dovecot_plain authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:38622: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  4 18:11:14 ait sshd[74957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Feb  4 18:11:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Feb  4 18:11:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  4 18:11:14 ait sshd[74957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Feb  4 18:11:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Feb  4 18:11:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-02-04 18:11:29 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:53542: 535 Incorrect authentication data (set_id=obiri)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-11.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-02-04 18:11:30 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:53402: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.173.81
description:
Feb  4 18:11:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.173.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Feb  4 18:11:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-02-04 18:11:23 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:57194: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.79.100
description:
[2025-02-04 18:11:44 +0100] info [webmaild] 176.29.79.100 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-02-04 18:11:16 dovecot_plain authenticator failed for ([117.69.210.199]) [117.69.210.199]:58956: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.13.21.246
description:
Feb  4 18:11:55 ait sshd[75164]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.13.21.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.13.21.246
description:
Feb  4 18:11:55 ait sshd[75164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.13.21.246  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Feb  4 18:11:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-02-04 18:11:25 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:36624: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 18:12:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.105.141.170
description:
Feb  4 18:13:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.105.141.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.145.177
description:
[2025-02-04 18:12:51 +0100] info [webmaild] 179.125.145.177 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.67.185.48
description:
Feb  4 18:12:30 ait sshd[75285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.67.185.48


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.67.185.48
description:
Feb  4 18:12:30 ait sshd[75285]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.67.185.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.161.197.130
description:
Feb  4 18:12:26 ait sshd[75265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.161.197.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.161.197.130
description:
Feb  4 18:12:26 ait sshd[75265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.161.197.130  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.110.153.182
description:
[2025-02-04 18:12:17 +0100] info [webmaild] 37.110.153.182 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.99.13.82
description:
Feb  4 18:13:54 ait sshd[75713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.99.13.82


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.250.204.51
description:
[2025-02-04 18:14:05 +0100] info [webmaild] 186.250.204.51 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 18:13:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Feb  4 18:13:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.99.13.82
description:
Feb  4 18:13:54 ait sshd[75713]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.99.13.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.231.137.153
description:
Feb  4 18:14:10 ait sshd[76019]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.231.137.153 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.231.137.153
description:
Feb  4 18:14:10 ait sshd[76019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.231.137.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.170
description:
2025-02-04 18:13:12 dovecot_plain authenticator failed for static-200-105-141-170.acelerate.net (static-200-105-141-161.acelerate.net) [200.105.141.170]:46520: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-02-04 18:13:29 dovecot_plain authenticator failed for ([115.22.247.178]) [115.22.247.178]:35260: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 52.231.137.153
description:
Feb  4 18:14:12 ait sshd[76019]: Failed password for invalid user goudirect from 52.231.137.153 port 50698 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.205.231.159
description:
Feb  4 18:14:23 ait sshd[76107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.205.231.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.115.100.144
description:
2025-02-04 18:14:26 dovecot_plain authenticator failed for 3pc100-144.rconx.com [185.115.100.144]:44177: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.115.100.144
description:
Feb  4 18:14:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.115.100.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 18:14:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.138.101.106
description:
Feb  4 18:14:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.138.101.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.48.150.219
description:
[2025-02-04 18:14:57 +0100] info [webmaild] 179.48.150.219 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.138.101.106
description:
2025-02-04 18:14:13 dovecot_plain authenticator failed for ([123.138.101.106]) [123.138.101.106]:43685: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.54.131.179
description:
[2025-02-04 18:14:44 +0100] info [webmaild] 186.54.131.179 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.248.192.204
description:
Feb  4 18:15:27 ait sshd[76720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 49.248.192.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.68.212.2
description:
Feb  4 18:15:36 ait sshd[76734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.68.212.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Feb  4 18:15:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.163.122.133
description:
2025-02-04 18:15:59 dovecot_login authenticator failed for ([182.163.122.133]) [182.163.122.133]:40161: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.248.192.204
description:
Feb  4 18:15:27 ait sshd[76720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.248.192.204


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.84.56.91
description:
[2025-02-04 18:15:31 +0100] info [webmaild] 103.84.56.91 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.77.118
description:
Feb  4 18:15:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.77.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.77.118
description:
2025-02-04 18:15:46 dovecot_login authenticator failed for ([122.227.77.118]) [122.227.77.118]:53772: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.163.122.133
description:
Feb  4 18:15:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.163.122.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-02-04 18:15:59 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:45711: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Feb  4 18:16:19 ait sshd[77005]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
description:
Feb  4 18:16:19 ait sshd[77011]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
description:
Feb  4 18:17:01 ait sshd[77288]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Feb  4 18:16:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Feb  4 18:16:19 ait sshd[77005]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
description:
Feb  4 18:16:19 ait sshd[77011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.170.20
description:
2025-02-04 18:16:42 dovecot_plain authenticator failed for broadband-188-32-170-20.ip.moscow.rt.ru [188.32.170.20]:55444: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
description:
Feb  4 18:17:01 ait sshd[77288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-02-04 18:16:15 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:60548: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.102.33
description:
Feb  4 18:16:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.102.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.102.33
description:
2025-02-04 18:16:32 dovecot_plain authenticator failed for ([112.186.102.33]) [112.186.102.33]:44647: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.170.20
description:
Feb  4 18:16:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.170.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.71.47.81
description:
[2025-02-04 18:17:05 +0100] info [webmaild] 103.71.47.81 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.133.214.161
description:
Feb  4 18:17:28 ait sshd[77516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.214.161


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.168.135
description:
[2025-02-04 18:17:42 +0100] info [webmaild] 177.221.168.135 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Feb  4 18:17:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.102.188.188
description:
Feb  4 18:17:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.102.188.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-02-04 18:17:47 dovecot_plain authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:59987: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.102.188.188
description:
2025-02-04 18:17:58 dovecot_plain authenticator failed for ([59.102.188.188]) [59.102.188.188]:34350: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-04 18:17:58 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:39612: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Feb  4 18:17:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-02-04 18:17:46 dovecot_plain authenticator failed for (197-91-173-203.dyn.mweb.co.za) [197.91.173.203]:50927: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.5.64.183
description:
[2025-02-04 18:17:49 +0100] info [webmaild] 189.5.64.183 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  4 18:17:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.102.76.10
description:
2025-02-04 18:18:30 dovecot_login authenticator failed for ([148.102.73.4]) [148.102.76.10]:49206: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.207.50
description:
Feb  4 18:18:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.207.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 18:18:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.148.0.56
description:
2025-02-04 18:18:19 dovecot_plain authenticator failed for 56.sub-166-148-0.myvzw.com [166.148.0.56]:54604: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.207.50
description:
2025-02-04 18:18:19 dovecot_login authenticator failed for vps-f5bece10.vps.ovh.net [135.125.207.50]:52382: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.185.199
description:
[2025-02-04 18:18:23 +0100] info [webmaild] 45.6.185.199 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.102.76.10
description:
Feb  4 18:18:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.102.76.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Feb  4 18:18:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.148.0.56
description:
Feb  4 18:18:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.148.0.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-02-04 18:18:36 dovecot_plain authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:36622: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.170.74.113
description:
[2025-02-04 18:18:54 +0100] info [cpaneld] 95.170.74.113 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.126.44.55
description:
[2025-02-04 18:19:56 +0100] info [webmaild] 185.126.44.55 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
description:
Feb  4 18:19:34 ait sshd[78409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Feb  4 18:19:16 ait sshd[78370]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Feb  4 18:19:16 ait sshd[78370]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
description:
Feb  4 18:19:34 ait sshd[78409]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 18:19:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
description:
Feb  4 18:19:12 ait sshd[78336]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
description:
Feb  4 18:19:12 ait sshd[78336]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.53.253.2
description:
Feb  4 18:21:04 ait sshd[79246]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.53.253.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.53.253.2
description:
Feb  4 18:21:04 ait sshd[79246]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.53.253.2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.19.169.120
description:
[2025-02-04 18:21:07 +0100] info [webmaild] 160.19.169.120 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.104.179.250
description:
[2025-02-04 18:20:35 +0100] info [webmaild] 193.104.179.250 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.72.133.195
description:
Feb  4 18:20:53 ait sshd[79095]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.72.133.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.86.242
description:
[2025-02-04 18:20:32 +0100] info [webmaild] 84.54.86.242 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.133.195
description:
Feb  4 18:20:53 ait sshd[79095]: pam_imunify(sshd:auth): [IM360_RBL] The IP 148.72.133.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.212.190.170
description:
Feb  4 18:21:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.212.190.170 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 199.188.207.151
description:
Feb  4 18:21:45 ait sshd[79414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=199.188.207.151  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.199.98.51
description:
2025-02-04 18:21:28 dovecot_plain authenticator failed for ([185.199.98.51]) [185.199.98.51]:43834: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Feb  4 18:21:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.199.98.51
description:
Feb  4 18:21:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.199.98.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.212.190.170
description:
2025-02-04 18:21:32 dovecot_plain authenticator failed for (176x212x190x170.dynamic.ryazan.ertelecom.ru) [176.212.190.170]:52922: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.245.237.193
description:
Feb  4 18:21:20 ait sshd[79304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.245.237.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.109
description:
Feb  4 18:21:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.109
description:
2025-02-04 18:21:41 dovecot_plain authenticator failed for (m121-202-201-109.smartone.com) [121.202.201.109]:2086: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.188.207.151
description:
Feb  4 18:21:45 ait sshd[79414]: pam_imunify(sshd:auth): [IM360_RBL] The IP 199.188.207.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.237.193
description:
Feb  4 18:21:20 ait sshd[79304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.245.237.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-02-04 18:21:20 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:60505: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.44.83.154
description:
Feb  4 18:22:24 ait sshd[79702]: pam_imunify(sshd:auth): [IM360_RBL] The IP 78.44.83.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.44.83.154
description:
Feb  4 18:22:24 ait sshd[79702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.44.83.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 18:22:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.192.32.55
description:
[2025-02-04 18:22:42 +0100] info [webmaild] 154.192.32.55 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.38.45.6
description:
[2025-02-04 18:22:49 +0100] info [webmaild] 189.38.45.6 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Feb  4 18:23:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Feb  4 18:23:17 ait sshd[80012]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 119.157.142.114
description:
[2025-02-04 18:23:17 +0100] info [webmaild] 119.157.142.114 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Feb  4 18:23:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-02-04 18:23:19 dovecot_plain authenticator failed for ([50.99.36.130]) [50.99.36.130]:57602: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.176.11.16
description:
[2025-02-04 18:23:20 +0100] info [webmaild] 200.176.11.16 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.118.249.163
description:
2025-02-04 18:23:23 dovecot_login authenticator failed for p174164-obmd01.osaka.ocn.ne.jp [61.118.249.163]:58317: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.109.195.179
description:
Feb  4 18:23:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.109.195.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Feb  4 18:23:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Feb  4 18:23:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.210.250
description:
2025-02-04 18:23:38 dovecot_plain authenticator failed for ([187.12.210.250]) [187.12.210.250]:40697: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Feb  4 18:23:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-02-04 18:23:17 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:36376: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  4 18:23:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.44.83.154
description:
Feb  4 18:23:45 ait sshd[80197]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.44.83.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Feb  4 18:23:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.210.250
description:
Feb  4 18:23:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.210.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.118.249.163
description:
Feb  4 18:23:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.118.249.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.47
description:
Feb  4 18:23:30 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.127.124.229
description:
2025-02-04 18:23:37 dovecot_plain authenticator failed for 229.red-217-127-124.staticip.rima-tde.net [217.127.124.229]:50463: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Feb  4 18:23:17 ait sshd[80012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-02-04 18:23:29 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:50712: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.44.83.154
description:
Feb  4 18:23:45 ait sshd[80197]: pam_imunify(sshd:auth): [IM360_RBL] The IP 78.44.83.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.128.108
description:
2025-02-04 18:23:13 dovecot_plain authenticator failed for ([39.129.128.108]) [39.129.128.108]:39604: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.109.195.179
description:
2025-02-04 18:23:31 dovecot_plain authenticator failed for ([183.109.195.179]) [183.109.195.179]:52782: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Feb  4 18:23:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.52.137
description:
2025-02-04 18:24:02 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:58640: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.112
description:
2025-02-04 18:23:31 dovecot_plain authenticator failed for (122.11.169-112.unknown.starhub.net.sg) [122.11.169.112]:1420: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.128.108
description:
Feb  4 18:23:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.128.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.190.181
description:
Feb  4 18:23:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.190.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.127.124.229
description:
Feb  4 18:23:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.127.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.84.34.85
description:
Feb  4 18:23:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.84.34.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-02-04 18:23:49 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:56678: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-04 18:23:23 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:45870: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.21.113
description:
2025-02-04 18:23:27 dovecot_plain authenticator failed for ([117.158.21.113]) [117.158.21.113]:33393: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-02-04 18:23:11 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:43168: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Feb  4 18:23:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.204.52.137
description:
Feb  4 18:24:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.204.52.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.47
description:
2025-02-04 18:23:32 dovecot_plain authenticator failed for (m121-202-155-47.smartone.com) [121.202.155.47]:30543: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-02-04 18:23:39 dovecot_login authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:60630: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.226.34.214
description:
[2025-02-04 18:23:49 +0100] info [webmaild] 91.226.34.214 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-02-04 18:23:18 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:54422: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.21.113
description:
Feb  4 18:23:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.21.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.190.181
description:
2025-02-04 18:23:29 dovecot_plain authenticator failed for ([47.149.190.181]) [47.149.190.181]:52953: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-02-04 18:23:43 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:57302: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
description:
2025-02-04 18:23:18 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:36736: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.111.34
description:
2025-02-04 18:24:33 dovecot_plain authenticator failed for ([180.168.111.34]) [180.168.111.34]:32967: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Feb  4 18:25:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.161.226.88
description:
2025-02-04 18:25:07 dovecot_plain authenticator failed for (187.161.226.88-clientes-izzi.mx) [187.161.226.88]:54451: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.43.58.99
description:
Feb  4 18:24:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.43.58.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
description:
Feb  4 18:24:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Feb  4 18:24:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-02-04 18:24:39 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:46882: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-02-04 18:24:44 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:50618: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.53.114.86
description:
Feb  4 18:24:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.53.114.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.175
description:
Feb  4 18:24:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
description:
2025-02-04 18:24:28 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:49625: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-02-04 18:24:41 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:14942: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
description:
2025-02-04 18:24:43 dovecot_plain authenticator failed for ([220.95.14.102]) [220.95.14.102]:45882: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
description:
Feb  4 18:24:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.43.58.99
description:
2025-02-04 18:24:26 dovecot_plain authenticator failed for host99.sub-63-43-58.myvzw.com [63.43.58.99]:24983: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Feb  4 18:24:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.48
description:
2025-02-04 18:24:50 dovecot_plain authenticator failed for 111-70-25-48.emome-ip.hinet.net [111.70.25.48]:42271: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-02-04 18:24:34 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:42656: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Feb  4 18:24:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.86.48
description:
2025-02-04 18:24:42 dovecot_plain authenticator failed for ([94.205.86.48]) [94.205.86.48]:40669: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.98.177.66
description:
Feb  4 18:24:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.98.177.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Feb  4 18:24:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.244.83.178
description:
Feb  4 18:24:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.244.83.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
description:
Feb  4 18:24:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-02-04 18:25:10 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br [186.247.192.94]:41437: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
description:
2025-02-04 18:24:27 dovecot_plain authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:55696: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.236
description:
2025-02-04 18:24:30 dovecot_plain authenticator failed for 111-70-23-236.emome-ip.hinet.net [111.70.23.236]:51412: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
description:
Feb  4 18:24:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.251
description:
2025-02-04 18:24:44 dovecot_plain authenticator failed for ([211.247.127.251]) [211.247.127.251]:45648: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-02-04 18:24:50 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:53231: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
description:
2025-02-04 18:24:40 dovecot_plain authenticator failed for ([181.233.93.3]) [181.233.93.66]:49793: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
description:
2025-02-04 18:24:45 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:8916: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.44.30
description:
Feb  4 18:24:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.44.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.236.91.93
description:
Feb  4 18:24:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.236.91.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Feb  4 18:24:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Feb  4 18:24:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Feb  4 18:24:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.197.38
description:
2025-02-04 18:24:37 dovecot_plain authenticator failed for ([166.195.197.38]) [166.195.197.38]:48244: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Feb  4 18:24:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 78.44.83.154
description:
Feb  4 18:24:55 ait sshd[80879]: Failed password for invalid user ventas01 from 78.44.83.154 port 55348 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.53.114.86
description:
2025-02-04 18:24:56 dovecot_plain authenticator failed for syn-067-053-114-086.biz.spectrum.com [67.53.114.86]:44433: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Feb  4 18:24:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.154.175
description:
Feb  4 18:24:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.154.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-02-04 18:24:28 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:60708: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
description:
2025-02-04 18:24:31 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:58128: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.111.34
description:
Feb  4 18:24:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.111.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.145.81
description:
Feb  4 18:24:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.145.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.0.126.91
description:
Feb  4 18:24:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.0.126.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.86.48
description:
Feb  4 18:24:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.86.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.125.146.242
description:
Feb  4 18:24:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.125.146.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.156.150
description:
2025-02-04 18:24:53 dovecot_plain authenticator failed for ([110.172.156.150]) [110.172.156.150]:50689: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.56.107.53
description:
Feb  4 18:24:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.56.107.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.120.67.149
description:
Feb  4 18:24:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.120.67.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.241.188
description:
2025-02-04 18:24:24 dovecot_plain authenticator failed for (85.105.241.188.static.ttnet.com.tr) [85.105.241.188]:56512: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.236
description:
Feb  4 18:24:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-02-04 18:24:31 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:59744: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
description:
2025-02-04 18:24:34 dovecot_plain authenticator failed for ([182.54.3.2]) [182.54.3.2]:46044: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-02-04 18:24:37 dovecot_plain authenticator failed for ([125.142.39.13]) [125.142.39.13]:34118: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
description:
2025-02-04 18:24:28 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:35901: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.28.154.169
description:
2025-02-04 18:24:39 dovecot_plain authenticator failed for s169-154-28-8.gec.tx.wi-power.com [8.28.154.169]:34186: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-02-04 18:24:40 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:50954: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.154.175
description:
2025-02-04 18:24:51 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.154.175]:60460: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
description:
Feb  4 18:25:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Feb  4 18:24:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Feb  4 18:24:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.62.233.146
description:
Feb  4 18:24:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.62.233.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
description:
Feb  4 18:24:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.100
description:
2025-02-04 18:24:40 dovecot_plain authenticator failed for (m121-202-153-100.smartone.com) [121.202.153.100]:61481: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.54.150
description:
Feb  4 18:24:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.54.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
description:
2025-02-04 18:24:36 dovecot_plain authenticator failed for ([41.216.84.18]) [41.216.84.18]:59779: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.66
description:
Feb  4 18:24:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.142
description:
Feb  4 18:24:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.251
description:
Feb  4 18:24:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.54.150
description:
2025-02-04 18:24:48 dovecot_plain authenticator failed for (150.54.169.61.dial.xw.sh.dynamic.163data.com.cn) [61.169.54.150]:41593: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-02-04 18:24:57 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:35564: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-02-04 18:24:45 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:13546: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.170.50.2
description:
Feb  4 18:24:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.170.50.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
description:
Feb  4 18:24:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
description:
2025-02-04 18:24:26 dovecot_plain authenticator failed for ([39.88.252.16]) [39.88.252.16]:40256: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
description:
2025-02-04 18:24:27 dovecot_plain authenticator failed for ([49.245.99.168]) [49.245.99.168]:42593: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.7.163
description:
2025-02-04 18:24:39 dovecot_plain authenticator failed for (abts-tn-static-163.7.185.136.airtelbroadband.in) [136.185.7.163]:33838: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.0.126.91
description:
2025-02-04 18:24:40 dovecot_plain authenticator failed for 190-0-126-91.sanluisctv.com.ar [190.0.126.91]:58085: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
description:
2025-02-04 18:24:40 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:57628: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.48
description:
Feb  4 18:24:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.172.156.150
description:
Feb  4 18:24:51 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.172.156.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Feb  4 18:24:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.64.208.228
description:
Feb  4 18:24:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.64.208.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.85.114
description:
2025-02-04 18:24:27 dovecot_plain authenticator failed for (189-20-32-73.customer.tdatabrasil.net.br) [186.200.85.114]:53198: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Feb  4 18:24:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-02-04 18:24:31 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:33683: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-02-04 18:24:43 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:13473: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.149.57
description:
2025-02-04 18:24:45 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.149.57]:57941: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.85.114
description:
Feb  4 18:24:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.85.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Feb  4 18:24:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Feb  4 18:24:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-02-04 18:24:28 dovecot_plain authenticator failed for ([161.35.200.202]) [161.35.200.202]:34102: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-02-04 18:25:02 dovecot_plain authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:55359: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-02-04 18:24:58 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:41402: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-02-04 18:24:26 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:16943: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
description:
Feb  4 18:24:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
description:
2025-02-04 18:24:28 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:54716: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.81
description:
2025-02-04 18:24:38 dovecot_plain authenticator failed for ([121.11.145.81]) [121.11.145.81]:52158: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.253.119
description:
2025-02-04 18:24:39 dovecot_plain authenticator failed for ([31.141.253.119]) [31.141.253.119]:51302: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.37.90
description:
2025-02-04 18:24:57 dovecot_plain authenticator failed for ([185.232.37.90]) [185.232.37.90]:36128: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.28.154.169
description:
Feb  4 18:24:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.28.154.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
description:
2025-02-04 18:24:40 dovecot_plain authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:43597: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
description:
2025-02-04 18:24:40 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:40522: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.37.90
description:
Feb  4 18:24:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.37.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.51.186
description:
Feb  4 18:24:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.51.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.253.119
description:
Feb  4 18:24:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.253.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-02-04 18:24:43 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:45894: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
description:
Feb  4 18:24:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.93.222.59
description:
2025-02-04 18:24:45 dovecot_plain authenticator failed for ([218.93.222.59]) [218.93.222.59]:36373: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-02-04 18:24:51 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:39627: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.151.114
description:
Feb  4 18:25:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.151.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-02-04 18:24:27 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:54549: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.185.7.163
description:
Feb  4 18:24:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.185.7.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
description:
Feb  4 18:24:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.45.225.98
description:
Feb  4 18:24:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.45.225.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.142
description:
2025-02-04 18:24:43 dovecot_plain authenticator failed for ([116.124.241.142]) [116.124.241.142]:39618: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
description:
2025-02-04 18:24:52 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:45013: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-02-04 18:25:06 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:45780: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.165.72.156
description:
2025-02-04 18:24:25 dovecot_plain authenticator failed for ([95.165.72.156]) [95.165.72.156]:34760: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.236.91.93
description:
2025-02-04 18:24:29 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [42.236.91.93]:42340: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-02-04 18:24:50 dovecot_plain authenticator failed for (static-TB-132-226.kbcnet.rs) [91.234.132.226]:42350: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.125.146.242
description:
2025-02-04 18:24:51 dovecot_plain authenticator failed for ([206.125.146.242]) [206.125.146.242]:44904: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-02-04 18:24:51 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:50062: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.100.105.194
description:
2025-02-04 18:24:59 dovecot_plain authenticator failed for d96469c2.static.ziggozakelijk.nl ([217.100.105.195]) [217.100.105.194]:49007: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Feb  4 18:24:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.100
description:
Feb  4 18:24:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Feb  4 18:24:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
description:
2025-02-04 18:24:39 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:52252: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.100.105.194
description:
Feb  4 18:24:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.100.105.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.151.114
description:
2025-02-04 18:25:05 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [27.72.151.114]:40133: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-02-04 18:24:31 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:42010: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.56.107.53
description:
2025-02-04 18:24:41 dovecot_plain authenticator failed for ([191.56.107.53]) [191.56.107.53]:33439: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Feb  4 18:24:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 18:24:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
description:
Feb  4 18:24:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-02-04 18:25:07 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:52072: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Feb  4 18:24:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.64.208.228
description:
2025-02-04 18:24:28 dovecot_plain authenticator failed for ([113.64.208.228]) [113.64.208.228]:44865: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-02-04 18:24:29 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:50724: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
description:
Feb  4 18:24:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.195.197.38
description:
Feb  4 18:24:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.195.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Feb  4 18:24:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.45.225.98
description:
2025-02-04 18:24:45 dovecot_plain authenticator failed for ([69.45.225.98]) [69.45.225.98]:57930: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.105.241.188
description:
Feb  4 18:24:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.105.241.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Feb  4 18:24:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
description:
Feb  4 18:24:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-02-04 18:24:26 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:45182: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.98.177.66
description:
2025-02-04 18:24:36 dovecot_plain authenticator failed for ([112.98.177.66]) [112.98.177.66]:42487: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
description:
2025-02-04 18:24:24 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:47109: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-02-04 18:24:41 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:42594: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.93.222.59
description:
Feb  4 18:24:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.93.222.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.44.83.154
description:
Feb  4 18:24:53 ait sshd[80879]: pam_imunify(sshd:auth): [IM360_RBL] The IP 78.44.83.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 78.44.83.154
description:
Feb  4 18:24:53 ait sshd[80879]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=78.44.83.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Feb  4 18:25:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.149.57
description:
Feb  4 18:24:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.149.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Feb  4 18:24:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.2
description:
Feb  4 18:24:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.5
description:
Feb  4 18:24:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-02-04 18:24:38 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:12743: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Feb  4 18:25:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.56.11.206
description:
Feb  4 18:25:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.56.11.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.10.46
description:
Feb  4 18:25:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.10.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.10.46
description:
2025-02-04 18:25:16 dovecot_plain authenticator failed for ([120.197.10.46]) [120.197.10.46]:52680: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
description:
Feb  4 18:25:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.225.109.30
description:
Feb  4 18:25:22 ait sshd[81383]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.225.109.30


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
description:
2025-02-04 18:25:24 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:33896: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.23.88
description:
47.128.23.88 - - [04/Feb/2025:18:25:30 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20578643 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/884df9?connection=default&page=explain&panel=db&query=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.23.88


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.131.25.91
description:
[2025-02-04 18:25:34 +0100] info [webmaild] 201.131.25.91 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.56.11.206
description:
2025-02-04 18:26:00 dovecot_plain authenticator failed for ([165.56.11.206]) [165.56.11.206]:48959: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.2
description:
Feb  4 18:26:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.200.27
description:
[2025-02-04 18:26:11 +0100] info [webmaild] 168.228.200.27 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.109.30
description:
Feb  4 18:25:22 ait sshd[81383]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.225.109.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.41.23.22
description:
[2025-02-04 18:25:59 +0100] info [webmaild] 38.41.23.22 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-02-04 18:27:19 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:34322: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Feb  4 18:27:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-02-04 18:27:47 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:34606: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-02-04 18:27:50 dovecot_plain authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:44789: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
description:
Feb  4 18:27:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-02-04 18:27:35 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:36110: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.45.225.98
description:
Feb  4 18:27:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.45.225.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.45.225.98
description:
2025-02-04 18:27:40 dovecot_plain authenticator failed for ([69.45.225.98]) [69.45.225.98]:41372: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-02-04 18:27:41 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:55079: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Feb  4 18:27:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.57.42
description:
2025-02-04 18:27:55 dovecot_plain authenticator failed for (45.170.57.42.accesslinkbr.com.br) [45.170.57.42]:48074: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Feb  4 18:27:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-02-04 18:28:00 dovecot_plain authenticator failed for ([95.79.108.51]) [95.79.108.51]:59760: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Feb  4 18:27:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
description:
2025-02-04 18:27:35 dovecot_plain authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:44540: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Feb  4 18:27:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Feb  4 18:27:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Feb  4 18:27:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-02-04 18:27:57 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:57771: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.24.154.232
description:
Feb  4 18:28:33 ait sshd[82764]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.24.154.232 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.24.154.232
description:
Feb  4 18:28:33 ait sshd[82764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.24.154.232  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Feb  4 18:29:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  4 18:29:07 ait sshd[82902]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-02-04 18:28:51 dovecot_plain authenticator failed for (jetozymic) [95.79.108.51]:34897: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.224.237.96
description:
[2025-02-04 18:28:53 +0100] info [webmaild] 38.224.237.96 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.177
description:
Feb  4 18:29:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.177 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.234.81.118
description:
[2025-02-04 18:28:38 +0100] info [webmaild] 88.234.81.118 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Feb  4 18:28:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.60.65.175
description:
[2025-02-04 18:28:15 +0100] info [webmaild] 179.60.65.175 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  4 18:29:07 ait sshd[82902]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.177
description:
2025-02-04 18:29:09 dovecot_plain authenticator failed for ([167.250.119.177]) [167.250.119.177]:34872: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-02-04 18:29:03 dovecot_plain authenticator failed for ([103.174.34.49]) [103.174.34.49]:58290: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Feb  4 18:29:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.75
description:
Feb  4 18:29:43 ait sshd[83307]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.75


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
description:
Feb  4 18:29:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.22.206
description:
Feb  4 18:29:40 ait sshd[83274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.22.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
description:
Feb  4 18:29:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-02-04 18:29:26 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:47983: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
description:
2025-02-04 18:29:30 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:48604: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.22.206
description:
Feb  4 18:29:40 ait sshd[83274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.22.206  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
description:
2025-02-04 18:29:19 dovecot_plain authenticator failed for (189-44-133-238.customer.tdatabrasil.net.br) [189.44.133.238]:39512: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.57.217.38
description:
Feb  4 18:29:20 ait sshd[83220]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.57.217.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.57.217.38
description:
Feb  4 18:29:20 ait sshd[83220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.57.217.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-02-04 18:29:20 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com [81.237.110.29]:43564: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.75
description:
Feb  4 18:29:43 ait sshd[83307]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
description:
2025-02-04 18:29:13 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:42406: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Feb  4 18:29:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.244.83.178
description:
Feb  4 18:29:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.244.83.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 18:29:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.72.203.252
description:
Feb  4 18:29:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.72.203.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-02-04 18:29:42 dovecot_plain authenticator failed for ([1.227.228.136]) [1.227.228.136]:41943: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.167.55
description:
[2025-02-04 18:29:16 +0100] info [webmaild] 45.165.167.55 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.8.107.66
description:
[2025-02-04 18:31:07 +0100] info [webmaild] 195.8.107.66 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-30.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.98.223.56
description:
[2025-02-04 18:32:03 +0100] info [webmaild] 179.98.223.56 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.181.35.47
description:
[2025-02-04 18:31:23 +0100] info [webmaild] 185.181.35.47 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 18:31:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.139.138.94
description:
[2025-02-04 18:31:42 +0100] info [webmaild] 185.139.138.94 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.17.80
description:
Feb  4 18:32:13 ait sshd[84650]: pam_imunify(sshd:auth): [IM360_RBL] The IP 57.129.17.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 57.129.17.80
description:
Feb  4 18:32:13 ait sshd[84650]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=57.129.17.80


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 18.231.150.126
description:
Feb  4 18:32:20 ait sshd[84671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=18.231.150.126


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.212.54
description:
Feb  4 18:33:58 ait sshd[85292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.212.54  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.200.198.25
description:
[2025-02-04 18:34:02 +0100] info [webmaild] 149.200.198.25 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.229.190.3
description:
[2025-02-04 18:34:08 +0100] info [webmaild] 181.229.190.3 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.212.54
description:
Feb  4 18:33:58 ait sshd[85292]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.212.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.240.84.120
description:
Feb  4 18:33:17 ait sshd[85069]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.240.84.120 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.240.84.120
description:
Feb  4 18:33:17 ait sshd[85069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.240.84.120


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
description:
Feb  4 18:34:27 ait sshd[85720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
description:
Feb  4 18:34:27 ait sshd[85720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
description:
2025-02-04 18:34:35 dovecot_plain authenticator failed for (ucicinemas.static.gvt.net.br) [186.215.204.109]:40340: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.178.130
description:
Feb  4 18:34:37 ait sshd[85757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.237.178.130 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.237.178.130
description:
Feb  4 18:34:37 ait sshd[85757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.237.178.130  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.33.44.158
description:
2025-02-04 18:34:23 dovecot_plain authenticator failed for ([89.33.44.158]) [89.33.44.158]:48150: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.204.109
description:
Feb  4 18:34:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.204.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.189.11.121
description:
[2025-02-04 18:34:42 +0100] info [webmaild] 103.189.11.121 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.61.100
description:
47.128.61.100 - - [04/Feb/2025:18:34:46 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14097846 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/5/?duration=short&filtering=1&instructor=2&level=beginner&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.61.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.33.44.158
description:
Feb  4 18:34:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.33.44.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 207.248.20.160
description:
[2025-02-04 18:34:39 +0100] info [webmaild] 207.248.20.160 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 18:34:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Feb  4 18:35:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.200.168.8
description:
Feb  4 18:35:18 ait sshd[86141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 35.200.168.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.39.158
description:
2025-02-04 18:36:02 dovecot_plain authenticator failed for 95-31-39-158.broadband.corbina.ru [95.31.39.158]:56818: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.138
description:
47.128.122.138 - - [04/Feb/2025:18:35:11 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12343815 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/?filtering=1&duration=long" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.39.158
description:
Feb  4 18:36:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.39.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.254.23.40
description:
Feb  4 18:35:17 ait sshd[86143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.254.23.40 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.254.23.40
description:
Feb  4 18:35:17 ait sshd[86143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.254.23.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Feb  4 18:35:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-02-04 18:35:13 dovecot_plain authenticator failed for (odyname) [82.84.122.203]:61051: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 35.200.168.8
description:
Feb  4 18:35:18 ait sshd[86141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=35.200.168.8


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-02-04 18:36:36 dovecot_plain authenticator failed for ([196.201.20.98]) [41.190.39.142]:54372: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-02-04 18:36:47 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:23086: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.160.70
description:
Feb  4 18:36:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.160.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.72.128.185
description:
2025-02-04 18:36:56 dovecot_plain authenticator failed for (187-072-128-185.static.ctbctelecom.com.br) [187.72.128.185]:59242: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
description:
Feb  4 18:37:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.34.244.190
description:
Feb  4 18:36:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.34.244.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
description:
2025-02-04 18:36:40 dovecot_plain authenticator failed for ([111.225.207.166]) [111.225.207.166]:58330: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
description:
Feb  4 18:36:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Feb  4 18:37:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
description:
2025-02-04 18:37:06 dovecot_plain authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:36269: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.101
description:
2025-02-04 18:36:33 dovecot_plain authenticator failed for ([207.219.221.101]) [207.219.221.101]:36848: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.34.244.190
description:
2025-02-04 18:36:36 dovecot_plain authenticator failed for ([36.34.244.190]) [36.34.244.190]:47892: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Feb  4 18:36:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
description:
2025-02-04 18:36:52 dovecot_plain authenticator failed for ([183.237.33.162]) [183.237.33.162]:30480: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.170
description:
2025-02-04 18:36:37 dovecot_plain authenticator failed for ([220.77.182.170]) [220.77.182.170]:35259: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
description:
2025-02-04 18:36:43 dovecot_plain authenticator failed for (videoifolder.ru) [78.108.186.10]:44352: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-02-04 18:36:50 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:34114: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.138.244
description:
2025-02-04 18:36:50 dovecot_plain authenticator failed for 244.79-161-138.customer.lyse.net [79.161.138.244]:51114: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 18:36:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-02-04 18:36:59 dovecot_plain authenticator failed for (ached) [81.211.77.58]:1064: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Feb  4 18:36:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Feb  4 18:36:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Feb  4 18:37:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-02-04 18:36:38 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:33852: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-02-04 18:36:45 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:45110: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 18:36:54 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:48561: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.26.70.70
description:
2025-02-04 18:36:57 dovecot_plain authenticator failed for ([1.26.70.70]) [1.26.70.70]:56669: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.143.14.7
description:
2025-02-04 18:36:54 dovecot_plain authenticator failed for ([117.143.14.7]) [117.143.14.7]:42716: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.136.27
description:
[2025-02-04 18:36:56 +0100] info [webmaild] 45.228.136.27 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-02-04 18:36:37 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:43648: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.123.153.214
description:
Feb  4 18:36:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.123.153.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.90.213.28
description:
2025-02-04 18:36:43 dovecot_plain authenticator failed for ool-4a5ad51c.dyn.optonline.net [74.90.213.28]:53976: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
description:
Feb  4 18:36:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.72.128.185
description:
Feb  4 18:36:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.72.128.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Feb  4 18:36:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.176
description:
2025-02-04 18:36:22 dovecot_plain authenticator failed for (nsg-corporate-176.229.187.122.airtel.in) [122.187.229.176]:44879: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.170
description:
Feb  4 18:36:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.236.141.106
description:
2025-02-04 18:36:39 dovecot_plain authenticator failed for ([87.236.141.106]) [87.236.141.106]:52462: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Feb  4 18:36:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-02-04 18:36:50 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:44624: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-02-04 18:36:54 dovecot_plain authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:45600: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-02-04 18:37:09 dovecot_plain authenticator failed for (pootines) [41.248.243.181]:43560: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.98.28.43
description:
2025-02-04 18:36:34 dovecot_plain authenticator failed for ([14.98.28.43]) [14.98.28.43]:45636: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.225.207.166
description:
Feb  4 18:36:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.225.207.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.98.28.43
description:
Feb  4 18:36:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.98.28.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-02-04 18:36:50 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:50513: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-02-04 18:37:00 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:59156: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.149.154
description:
Feb  4 18:36:18 ait sshd[86534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.56.149.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.171.195.70
description:
Feb  4 18:36:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.171.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-02-04 18:36:42 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:48157: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.202.11
description:
2025-02-04 18:37:01 dovecot_plain authenticator failed for (381859.cloudwaysapps.com) [128.199.202.11]:35966: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.104.245
description:
Feb  4 18:36:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.104.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.123.153.214
description:
2025-02-04 18:36:42 dovecot_plain authenticator failed for ([144.123.153.214]) [144.123.153.214]:37346: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.129.6.100
description:
Feb  4 18:36:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.129.6.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Feb  4 18:36:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
description:
Feb  4 18:36:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.56.149.154
description:
Feb  4 18:36:18 ait sshd[86534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.56.149.154


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.101
description:
Feb  4 18:36:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.26.70.70
description:
Feb  4 18:36:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.26.70.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-02-04 18:37:05 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:49974: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.224.64
description:
[2025-02-04 18:36:42 +0100] info [webmaild] 143.202.224.64 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Feb  4 18:36:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.143.14.7
description:
Feb  4 18:36:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.143.14.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Feb  4 18:36:35 ait sshd[86647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
description:
Feb  4 18:36:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Feb  4 18:36:35 ait sshd[86647]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-02-04 18:36:36 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:35987: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.62.34.216
description:
Feb  4 18:36:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.62.34.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-02-04 18:36:49 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:54801: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.160.70
description:
2025-02-04 18:36:58 dovecot_plain authenticator failed for ([183.238.160.70]) [183.238.160.70]:34110: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.176
description:
Feb  4 18:36:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
description:
2025-02-04 18:36:33 dovecot_plain authenticator failed for ([216.171.195.70]) [216.171.195.70]:55487: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
description:
Feb  4 18:36:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.236.141.106
description:
Feb  4 18:36:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.236.141.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.104.245
description:
2025-02-04 18:36:39 dovecot_plain authenticator failed for ([179.125.104.245]) [179.125.104.245]:58484: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Feb  4 18:36:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.90.213.28
description:
Feb  4 18:36:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.90.213.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Feb  4 18:36:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Feb  4 18:36:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-02-04 18:36:36 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:33618: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.161.138.244
description:
Feb  4 18:36:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.161.138.244 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Feb  4 18:36:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Feb  4 18:36:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.202.11
description:
Feb  4 18:36:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.202.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
description:
2025-02-04 18:36:46 dovecot_plain authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:41505: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Feb  4 18:36:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.62.34.216
description:
2025-02-04 18:36:50 dovecot_plain authenticator failed for c-71-62-34-216.hsd1.va.comcast.net [71.62.34.216]:33816: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-02-04 18:36:52 dovecot_plain authenticator failed for (static-TB-132-226.kbcnet.rs) [91.234.132.226]:43771: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Feb  4 18:36:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-02-04 18:36:46 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:49594: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-02-04 18:37:12 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (unflike) [176.37.212.85]:53961: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Feb  4 18:37:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.193.18
description:
[2025-02-04 18:37:29 +0100] info [webmaild] 45.173.193.18 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 139.135.34.1
description:
[2025-02-04 18:37:33 +0100] info [webmaild] 139.135.34.1 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.157.107.67
description:
Feb  4 18:37:59 ait sshd[87301]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.157.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.157.107.67
description:
Feb  4 18:37:59 ait sshd[87301]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.157.107.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.37.212.85
description:
Feb  4 18:37:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.37.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.165.243.10
description:
Feb  4 18:38:07 ait sshd[87337]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.165.243.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-02-04 18:37:14 dovecot_plain authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:40562: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.75
description:
Feb  4 18:37:20 ait sshd[86964]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.75 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.75
description:
Feb  4 18:37:20 ait sshd[86964]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.75


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.165.243.10
description:
Feb  4 18:38:07 ait sshd[87337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.165.243.10


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.165.243.10
description:
Feb  4 18:38:10 ait sshd[87337]: Failed password for invalid user goudirect from 103.165.243.10 port 53638 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.96.43.215
description:
Feb  4 18:38:33 ait sshd[87642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 42.96.43.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.96.43.215
description:
Feb  4 18:38:33 ait sshd[87642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.96.43.215


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 50.114.106.169
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:StephenAJnr||WPU:StephenAJnr||RSV:6.65||T:APACHE||MV:18-38.50.114.106.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Feb  4 18:39:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-02-04 18:39:59 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:56398: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Feb  4 18:39:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.251.49.106
description:
2025-02-04 18:39:14 dovecot_plain authenticator failed for 116-251-49-106.pool.activ8me.net.au [116.251.49.106]:53286: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-02-04 18:39:27 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:55870: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.82.18
description:
Feb  4 18:39:15 ait sshd[87846]: pam_imunify(sshd:auth): [IM360_RBL] The IP 67.213.82.18 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 67.213.82.18
description:
Feb  4 18:39:16 ait sshd[87846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=67.213.82.18  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.70.166.51
description:
Feb  4 18:39:46 ait sshd[88290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.70.166.51 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.131.106.214
description:
[2025-02-04 18:39:38 +0100] info [webmaild] 37.131.106.214 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.70.166.51
description:
Feb  4 18:39:46 ait sshd[88290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.70.166.51  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.209.137.62
description:
[2025-02-04 18:39:56 +0100] info [webmaild] 102.209.137.62 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.251.49.106
description:
Feb  4 18:39:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.251.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.14
description:
2025-02-04 18:40:31 dovecot_plain authenticator failed for ([125.90.72.14]) [125.90.72.14]:52655: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 62.109.0.115
description:
Feb  4 18:40:36 ait sshd[88815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.109.0.115


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.87.119.190
description:
[2025-02-04 18:40:12 +0100] info [webmaild] 187.87.119.190 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.225.109.30
description:
Feb  4 18:40:29 ait sshd[88799]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.225.109.30  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.109.0.115
description:
Feb  4 18:40:36 ait sshd[88815]: pam_imunify(sshd:auth): [IM360_RBL] The IP 62.109.0.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.14
description:
Feb  4 18:40:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.225.109.30
description:
Feb  4 18:40:29 ait sshd[88799]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.225.109.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.76.61.17
description:
Feb  4 18:41:40 ait sshd[89137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.76.61.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.61.17
description:
Feb  4 18:41:40 ait sshd[89137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.61.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
description:
Feb  4 18:42:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-02-04 18:42:14 dovecot_plain authenticator failed for (suggicos) [65.20.160.195]:33212: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.82.116
description:
[2025-02-04 18:42:22 +0100] info [webmaild] 213.230.82.116 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.104.187
description:
Feb  4 18:42:58 ait sshd[89487]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.106.104.187 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.106.104.187
description:
Feb  4 18:42:58 ait sshd[89487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.106.104.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.117.180.89
description:
[2025-02-04 18:42:21 +0100] info [webmaild] 196.117.180.89 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 18:42:31 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.72.155.208
description:
[2025-02-04 18:42:55 +0100] info [webmaild] 94.72.155.208 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.153.149
description:
[2025-02-04 18:42:58 +0100] info [webmaild] 179.127.153.149 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Feb  4 18:43:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.22.195.6
description:
Feb  4 18:44:04 ait sshd[89915]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.22.195.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.22.195.6
description:
Feb  4 18:44:04 ait sshd[89915]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.195.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.184.23
description:
[2025-02-04 18:45:03 +0100] info [webmaild] 177.54.184.23 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.0.11.107
description:
[2025-02-04 18:45:07 +0100] info [webmaild] 102.0.11.107 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.130.116.100
description:
Feb  4 18:44:37 ait sshd[90152]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.130.116.100  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.75
description:
Feb  4 18:44:53 ait sshd[90342]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 18:44:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.130.116.100
description:
Feb  4 18:44:37 ait sshd[90152]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.130.116.100 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.75
description:
Feb  4 18:44:53 ait sshd[90342]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.75


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.151.239.210
description:
Feb  4 18:45:23 ait sshd[90560]: pam_imunify(sshd:auth): [IM360_RBL] The IP 61.151.239.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Feb  4 18:45:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.145.202
description:
Feb  4 18:46:08 ait sshd[90828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.145.202 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-45.118.67.214.233


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.176.231
description:
2025-02-04 18:45:48 dovecot_plain authenticator failed for ([61.184.176.231]) [61.184.176.231]:46554: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-02-04 18:45:56 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:51096: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 61.151.239.210
description:
Feb  4 18:45:23 ait sshd[90560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.151.239.210


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.12.173.24
description:
[2025-02-04 18:45:36 +0100] info [webmaild] 103.12.173.24 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.176.231
description:
Feb  4 18:45:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.176.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.145.202
description:
Feb  4 18:46:08 ait sshd[90828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.145.202


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 72.252.32.10
description:
[2025-02-04 18:45:38 +0100] info [webmaild] 72.252.32.10 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Feb  4 18:46:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-02-04 18:47:00 dovecot_plain authenticator failed for ([187.93.153.166]) [187.93.153.166]:39704: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.96.145.202
description:
Feb  4 18:46:11 ait sshd[90828]: Failed password for invalid user goudirect from 119.96.145.202 port 32894 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
description:
Feb  4 18:46:13 ait sshd[90858]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
description:
Feb  4 18:46:13 ait sshd[90858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.175
description:
Feb  4 18:46:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
description:
2025-02-04 18:46:35 dovecot_plain authenticator failed for ([92.62.243.175]) [92.62.243.175]:36558: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-02-04 18:47:18 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:38540: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 18:47:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.59.228.24
description:
Feb  4 18:48:09 ait sshd[91557]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.59.228.24


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.90.226.193
description:
Feb  4 18:47:41 ait sshd[91494]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.90.226.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  4 18:47:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-04 18:47:19 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (flaing) [91.56.31.167]:64226: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
description:
Feb  4 18:47:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
description:
2025-02-04 18:47:34 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:51852: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.59.228.24
description:
Feb  4 18:48:09 ait sshd[91557]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.59.228.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.71.106.81
description:
[2025-02-04 18:47:52 +0100] info [webmaild] 186.71.106.81 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.22.195.6
description:
Feb  4 18:47:12 ait sshd[91166]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.22.195.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.22.195.6
description:
Feb  4 18:47:12 ait sshd[91166]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.195.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Feb  4 18:47:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.226.193
description:
Feb  4 18:47:41 ait sshd[91494]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.90.226.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.217.231.122
description:
[2025-02-04 18:47:42 +0100] info [webmaild] 179.217.231.122 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.18.138
description:
Feb  4 18:48:29 ait sshd[91617]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.152.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.22.195.6
description:
Feb  4 18:48:50 ait sshd[91806]: pam_imunify(sshd:auth): [IM360_RBL] The IP 160.22.195.6 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 146.59.228.24
description:
Feb  4 18:48:11 ait sshd[91557]: Failed password for invalid user goudirect from 146.59.228.24 port 56728 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.152.18.138
description:
Feb  4 18:48:29 ait sshd[91617]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.18.138


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 160.22.195.6
description:
Feb  4 18:48:52 ait sshd[91806]: Failed password for invalid user alex from 160.22.195.6 port 38452 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.21.36.111
description:
Feb  4 18:48:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.21.36.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
description:
Feb  4 18:48:14 ait sshd[91582]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.144.60.123
description:
Feb  4 18:48:28 ait sshd[91619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.144.60.123  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.96.211.211
description:
[2025-02-04 18:48:28 +0100] info [webmaild] 41.96.211.211 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 160.22.195.6
description:
Feb  4 18:48:50 ait sshd[91806]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=160.22.195.6


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.219.38.32
description:
[2025-02-04 18:48:13 +0100] info [webmaild] 200.219.38.32 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.194.71.195
description:
Feb  4 18:48:17 ait sshd[91586]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.194.71.195


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.53.253.2
description:
Feb  4 18:48:27 ait sshd[91597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.53.253.2  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.53.253.2
description:
Feb  4 18:48:27 ait sshd[91597]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.53.253.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.144.60.123
description:
Feb  4 18:48:28 ait sshd[91619]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.144.60.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.111
description:
2025-02-04 18:49:01 dovecot_login authenticator failed for ([14.21.36.111]) [14.21.36.111]:58657: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
description:
Feb  4 18:48:14 ait sshd[91582]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.71.195
description:
Feb  4 18:48:17 ait sshd[91586]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.194.71.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.66.153.194
description:
Feb  4 18:49:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.66.153.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.153.194
description:
2025-02-04 18:49:24 dovecot_login authenticator failed for ([95.66.153.194]) [95.66.153.194]:48884: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.143.3.132
description:
Feb  4 18:49:41 ait sshd[92194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.143.3.132 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.143.3.132
description:
Feb  4 18:49:41 ait sshd[92194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.143.3.132  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.130.215.226
description:
Feb  4 18:49:39 ait sshd[92177]: pam_imunify(sshd:auth): [IM360_RBL] The IP 34.130.215.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.130.215.226
description:
Feb  4 18:49:39 ait sshd[92177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.130.215.226


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-02-04 18:50:52 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:54352: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Feb  4 18:51:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
description:
2025-02-04 18:51:11 dovecot_plain authenticator failed for ([121.202.152.24]) [121.202.152.24]:20884: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.2.198
description:
2025-02-04 18:50:29 dovecot_plain authenticator failed for 111-70-2-198.emome-ip.hinet.net [111.70.2.198]:47135: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.70.158
description:
Feb  4 18:50:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.70.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
description:
Feb  4 18:51:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.17.228
description:
[2025-02-04 18:50:28 +0100] info [webmaild] 45.165.17.228 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.204.212
description:
[2025-02-04 18:50:41 +0100] info [webmaild] 45.163.204.212 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 178.62.227.127
description:
Feb  4 18:50:49 ait sshd[93011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=178.62.227.127  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.175.227.204
description:
[2025-02-04 18:50:59 +0100] info [webmaild] 105.175.227.204 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.226.193
description:
Feb  4 18:51:03 ait sshd[93112]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.90.226.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.90.226.193
description:
Feb  4 18:51:03 ait sshd[93112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.90.226.193


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-50.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.2.198
description:
Feb  4 18:50:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.2.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.62.227.127
description:
Feb  4 18:50:49 ait sshd[93011]: pam_imunify(sshd:auth): [IM360_RBL] The IP 178.62.227.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-02-04 18:51:04 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:34788: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.70.158
description:
2025-02-04 18:50:48 dovecot_plain authenticator failed for ([200.151.70.158]) [200.151.70.158]:45857: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Feb  4 18:50:50 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.18.138
description:
Feb  4 18:51:13 ait sshd[93143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.152.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.152.18.138
description:
Feb  4 18:51:13 ait sshd[93143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.18.138


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.8.116.14
description:
[2025-02-04 18:51:14 +0100] info [webmaild] 95.8.116.14 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
description:
Feb  4 18:51:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
description:
2025-02-04 18:51:22 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:53293: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-02-04 18:52:40 dovecot_plain authenticator failed for ([207.188.157.230]) [207.188.157.230]:15276: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.226.193
description:
Feb  4 18:52:43 ait sshd[93667]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.90.226.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.90.226.193
description:
Feb  4 18:52:43 ait sshd[93667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.90.226.193


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.18.138
description:
Feb  4 18:52:50 ait sshd[93742]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.152.18.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.152.18.138
description:
Feb  4 18:52:50 ait sshd[93742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.152.18.138


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-02-04 18:52:59 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:46098: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Feb  4 18:52:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.192.218
description:
[2025-02-04 18:53:08 +0100] info [webmaild] 160.238.192.218 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Feb  4 18:52:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  4 18:53:21 ait sshd[93832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.16.120.43
description:
[2025-02-04 18:53:41 +0100] info [webmaild] 181.16.120.43 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.25.9.2
description:
[2025-02-04 18:53:54 +0100] info [webmaild] 38.25.9.2 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.230.230.46
description:
[2025-02-04 18:53:19 +0100] info [webmaild] 94.230.230.46 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  4 18:53:21 ait sshd[93832]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-02-04 18:54:19 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:41988: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-02-04 18:54:23 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:47824: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.50.134.183
description:
Feb  4 18:54:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.50.134.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.50.134.183
description:
2025-02-04 18:54:28 dovecot_plain authenticator failed for ([77.50.134.183]) [77.50.134.183]:51424: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.67.92
description:
Feb  4 18:54:11 ait sshd[94101]: pam_imunify(sshd:auth): [IM360_RBL] The IP 23.95.67.92 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
description:
Feb  4 18:54:12 ait sshd[94119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Feb  4 18:55:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-02-04 18:55:11 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:57008: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
description:
Feb  4 18:54:12 ait sshd[94119]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.40.10
description:
2025-02-04 18:55:05 dovecot_plain authenticator failed for ([112.6.73.140]) [221.2.40.10]:36817: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 23.95.67.92
description:
Feb  4 18:54:11 ait sshd[94101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.95.67.92


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Feb  4 18:54:17 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Feb  4 18:54:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
description:
Feb  4 18:54:44 ait sshd[94326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Feb  4 18:54:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-02-04 18:54:37 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:54755: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
description:
Feb  4 18:54:44 ait sshd[94326]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-02-04 18:55:29 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:38879: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.215.133.102
description:
Feb  4 18:55:33 ait sshd[94757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.215.133.102


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.145.129
description:
[2025-02-04 18:56:09 +0100] info [webmaild] 186.249.145.129 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Feb  4 18:55:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.138.75.18
description:
Feb  4 18:56:03 ait sshd[94966]: pam_imunify(sshd:auth): [IM360_RBL] The IP 174.138.75.18 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.67.83
description:
Feb  4 18:56:09 ait sshd[94986]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.67.83


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Feb  4 18:55:23 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 18:55:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.89.170.81
description:
Feb  4 18:55:27 ait sshd[94749]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.89.170.81


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.215.133.102
description:
Feb  4 18:55:33 ait sshd[94757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.215.133.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-02-04 18:55:25 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:42266: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.170.81
description:
Feb  4 18:55:27 ait sshd[94749]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.89.170.81 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.41.115.68
description:
[2025-02-04 18:55:54 +0100] info [webmaild] 103.41.115.68 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.151.218.110
description:
Feb  4 18:55:41 ait sshd[94911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.151.218.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Feb  4 18:55:27 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.235.158
description:
Feb  4 18:55:54 ait sshd[94946]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.235.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-02-04 18:55:43 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:40052: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.67.83
description:
Feb  4 18:56:09 ait sshd[94986]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.67.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-02-04 18:55:29 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:40317: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 18:55:35 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:60244: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.18.139.82
description:
Feb  4 18:55:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.18.139.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.235.158
description:
Feb  4 18:55:54 ait sshd[94946]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.235.158


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 174.138.75.18
description:
Feb  4 18:56:03 ait sshd[94966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=174.138.75.18


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.151.218.110
description:
Feb  4 18:55:41 ait sshd[94911]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.151.218.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.95.112.29
description:
2025-02-04 18:56:41 dovecot_plain authenticator failed for c-73-95-112-29.hsd1.co.comcast.net [73.95.112.29]:33352: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
description:
2025-02-04 18:57:00 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:40520: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 40.127.67.83
description:
Feb  4 18:56:11 ait sshd[94986]: Failed password for invalid user postmaster from 40.127.67.83 port 43506 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Feb  4 18:56:29 ait sshd[95056]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.211.189.210
description:
Feb  4 18:56:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.211.189.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.158.215.228
description:
[2025-02-04 18:56:27 +0100] info [webmaild] 200.158.215.228 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Feb  4 18:56:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Feb  4 18:56:29 ait sshd[95056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.71.254.195
description:
[2025-02-04 18:56:43 +0100] info [webmaild] 190.71.254.195 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.25.254
description:
Feb  4 18:56:19 ait sshd[95025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 128.199.25.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 128.199.25.254
description:
Feb  4 18:56:19 ait sshd[95025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.199.25.254


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
description:
Feb  4 18:56:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-02-04 18:56:45 dovecot_plain authenticator failed for ([60.213.27.250]) [60.213.27.250]:35680: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.211.189.210
description:
2025-02-04 18:56:38 dovecot_login authenticator failed for (qgYBWTZ) [4.211.189.210]:64455: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.231.247.210
description:
2025-02-04 18:56:39 dovecot_plain authenticator failed for ([101.231.247.210]) [101.231.247.210]:39741: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.95.112.29
description:
Feb  4 18:56:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.95.112.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.23.172
description:
Feb  4 18:56:42 ait sshd[95286]: pam_imunify(sshd:auth): [IM360_RBL] The IP 159.203.23.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Feb  4 18:56:57 ait sshd[95323]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-02-04 18:56:20 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:51947: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.231.247.210
description:
Feb  4 18:56:37 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.231.247.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.86.21
description:
Feb  4 18:56:58 ait sshd[95339]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.86.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.86.21
description:
Feb  4 18:56:58 ait sshd[95339]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.86.21


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.106.23.215
description:
Feb  4 18:57:01 ait sshd[95351]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.106.23.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-02-04 18:56:56 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:52058: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.106.23.215
description:
Feb  4 18:57:01 ait sshd[95351]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.106.23.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 159.203.23.172
description:
Feb  4 18:56:42 ait sshd[95286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=159.203.23.172


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Feb  4 18:56:43 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Feb  4 18:56:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Feb  4 18:57:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-02-04 18:57:16 dovecot_plain authenticator failed for ([187.51.234.239]) [189.108.147.210]:41443: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.211.189.210
description:
Feb  4 18:57:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.211.189.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.211.189.210
description:
2025-02-04 18:57:31 dovecot_login authenticator failed for (upAQ1i) [4.211.189.210]:59212: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.206.91.51
description:
Feb  4 18:58:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.206.91.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
description:
2025-02-04 18:58:07 dovecot_plain authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:57129: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.66.41.130
description:
Feb  4 18:58:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.66.41.130 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 118.67.214.233
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:18-58.118.67.214.233


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.142.177
description:
[2025-02-04 18:58:35 +0100] info [webmaild] 167.250.142.177 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.211.189.210
description:
2025-02-04 18:59:06 dovecot_login authenticator failed for (HOPKaN) [4.211.189.210]:62746: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 18:58:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.252.38.24
description:
Feb  4 18:58:56 ait sshd[96066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.252.38.24


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.118.85.25
description:
[2025-02-04 18:58:58 +0100] info [webmaild] 103.118.85.25 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.211.189.210
description:
Feb  4 18:59:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.211.189.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.121.97.71
description:
[2025-02-04 18:59:07 +0100] info [webmaild] 154.121.97.71 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.66.41.130
description:
2025-02-04 18:58:17 dovecot_plain authenticator failed for 130.pool207-66-41.dynamic.orange.es [207.66.41.130]:56897: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.236.162.125
description:
Feb  4 18:58:41 ait sshd[95997]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.162.125


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.252.38.24
description:
Feb  4 18:58:56 ait sshd[96066]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.252.38.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.76.61.17
description:
Feb  4 18:59:57 ait sshd[96537]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.76.61.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.121.10
description:
Feb  4 18:59:57 ait sshd[96540]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.72.121.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
description:
2025-02-04 19:00:05 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:39281: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.158.161.99
description:
Feb  4 18:59:49 ait sshd[96509]: pam_imunify(sshd:auth): [IM360_RBL] The IP 124.158.161.99 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.61.17
description:
Feb  4 18:59:57 ait sshd[96537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.61.17


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.72.121.10
description:
Feb  4 18:59:57 ait sshd[96540]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.72.121.10  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.53.253.2
description:
Feb  4 18:59:17 ait sshd[96222]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.53.253.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.53.253.2
description:
Feb  4 18:59:17 ait sshd[96222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.53.253.2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.3.200.95
description:
[2025-02-04 18:59:32 +0100] info [webmaild] 197.3.200.95 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
description:
Feb  4 18:59:46 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
description:
2025-02-04 18:59:48 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:47110: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 124.158.161.99
description:
Feb  4 18:59:49 ait sshd[96509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=124.158.161.99  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.150.100.139
description:
Feb  4 19:00:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.150.100.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.212.0.13
description:
Feb  4 18:59:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.212.0.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.212.0.13
description:
2025-02-04 18:59:59 dovecot_plain authenticator failed for ([60.212.0.13]) [60.212.0.13]:56113: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.43.94
description:
Feb  4 19:00:47 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.43.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.150.100.139
description:
2025-02-04 19:00:10 dovecot_plain authenticator failed for ([107.150.100.139]) [107.150.100.139]:39510: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
description:
Feb  4 19:00:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
description:
2025-02-04 19:00:17 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:53619: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-02-04 19:00:35 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:60318: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.122.255.6
description:
Feb  4 19:00:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.122.255.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.122.255.6
description:
2025-02-04 19:00:17 dovecot_plain authenticator failed for ([58.122.255.6]) [58.122.255.6]:49502: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 74.208.51.38
description:
Feb  4 19:00:24 ait sshd[97041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=74.208.51.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.116.226
description:
Feb  4 19:00:28 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.116.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.116.226
description:
2025-02-04 19:00:30 dovecot_plain authenticator failed for ([117.176.116.226]) [117.176.116.226]:44468: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Feb  4 19:00:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.43.94
description:
2025-02-04 19:00:49 dovecot_plain authenticator failed for ([116.132.43.94]) [116.132.43.94]:59820: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.86.21
description:
Feb  4 19:01:09 ait sshd[97578]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.86.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.86.21
description:
Feb  4 19:01:09 ait sshd[97578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.86.21


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.163.9
description:
[2025-02-04 19:01:31 +0100] info [webmaild] 181.191.163.9 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.108.86
description:
[2025-02-04 19:01:44 +0100] info [webmaild] 45.169.108.86 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.2.234.106
description:
Feb  4 19:01:47 ait sshd[97819]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.2.234.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.153.183.147
description:
[2025-02-04 19:01:47 +0100] info [webmaild] 5.153.183.147 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Feb  4 19:02:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.86.21
description:
Feb  4 19:01:11 ait sshd[97578]: Failed password for invalid user psy from 103.149.86.21 port 58122 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.76.61.17
description:
Feb  4 19:01:42 ait sshd[97662]: pam_imunify(sshd:auth): [IM360_RBL] The IP 180.76.61.17 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.2.234.106
description:
Feb  4 19:01:47 ait sshd[97819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.2.234.106


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.248.55
description:
Feb  4 19:01:23 ait sshd[97630]: pam_imunify(sshd:auth): [IM360_RBL] The IP 209.38.248.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 180.76.61.17
description:
Feb  4 19:01:42 ait sshd[97662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=180.76.61.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-02-04 19:02:09 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (overelly) [83.254.126.238]:53154: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 209.38.248.55
description:
Feb  4 19:01:23 ait sshd[97630]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=209.38.248.55


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 19:01:25 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.149.86.21
description:
Feb  4 19:02:38 ait sshd[98222]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.149.86.21


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Feb  4 19:03:02 ait sshd[98453]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.248.27.95
description:
Feb  4 19:02:35 ait sshd[98216]: pam_imunify(sshd:auth): [IM360_RBL] The IP 104.248.27.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.86.21
description:
Feb  4 19:02:38 ait sshd[98222]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.149.86.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
description:
Feb  4 19:02:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.0.43.230
description:
[2025-02-04 19:02:21 +0100] info [webmaild] 179.0.43.230 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-02-04 19:02:20 dovecot_plain authenticator failed for (host-80-241-253-238.customer.magticom.ge) [2.57.219.2]:46340: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.248.27.95
description:
Feb  4 19:02:35 ait sshd[98216]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.248.27.95


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Feb  4 19:03:02 ait sshd[98453]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
description:
2025-02-04 19:02:41 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:42283: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Feb  4 19:02:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.149.86.21
description:
Feb  4 19:02:40 ait sshd[98222]: Failed password for invalid user mopps from 103.149.86.21 port 60320 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.56.18.8
description:
Feb  4 19:03:17 ait sshd[98530]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.56.18.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.210.107.22
description:
Feb  4 19:03:28 ait sshd[98543]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.210.107.22 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.127.68.180
description:
Feb  4 19:03:52 ait sshd[98771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.127.68.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Feb  4 19:03:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.200.36.250
description:
[2025-02-04 19:04:00 +0100] info [webmaild] 103.200.36.250 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.56.18.8
description:
Feb  4 19:03:17 ait sshd[98530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.56.18.8


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.210.107.22
description:
Feb  4 19:03:28 ait sshd[98543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.210.107.22


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.127.68.180
description:
Feb  4 19:03:52 ait sshd[98771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.127.68.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.206
description:
Feb  4 19:04:45 ait sshd[98940]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.67.185.48
description:
Feb  4 19:04:45 ait sshd[98942]: pam_imunify(sshd:auth): [IM360_RBL] The IP 40.67.185.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.133.214.161
description:
Feb  4 19:04:34 ait sshd[98897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.133.214.161


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 40.67.185.48
description:
Feb  4 19:04:45 ait sshd[98942]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=40.67.185.48


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.5.245.129
description:
Feb  4 19:04:19 ait sshd[98856]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.5.245.129 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.156.37.108
description:
[2025-02-04 19:04:32 +0100] info [webmaild] 102.156.37.108 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.5.245.129
description:
Feb  4 19:04:19 ait sshd[98856]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.5.245.129


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.206
description:
Feb  4 19:04:45 ait sshd[98940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.206  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.229.255.17
description:
[2025-02-04 19:05:06 +0100] info [webmaild] 103.229.255.17 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.134.4.35
description:
[2025-02-04 19:04:29 +0100] info [webmaild] 196.134.4.35 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-02-04 19:05:15 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:52978: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.172.72
description:
2025-02-04 19:05:57 dovecot_plain authenticator failed for (223-197-172-72.static.imsbiz.com) [223.197.172.72]:53321: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-02-04 19:06:03 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (savic) [89.153.62.100]:39964: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.244.163
description:
Feb  4 19:05:26 ait sshd[99511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.244.163


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.97.219.60
description:
Feb  4 19:05:20 ait sshd[99484]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.97.219.60


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.97.219.60
description:
Feb  4 19:05:20 ait sshd[99484]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.97.219.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.238.102.179
description:
2025-02-04 19:05:38 dovecot_plain authenticator failed for ([183.238.102.179]) [183.238.102.179]:33531: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.172.72
description:
Feb  4 19:05:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.172.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Feb  4 19:06:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Feb  4 19:05:13 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.244.163
description:
Feb  4 19:05:26 ait sshd[99511]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.244.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.238.102.179
description:
Feb  4 19:05:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.238.102.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Feb  4 19:05:10 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.247.87.75
description:
Feb  4 19:06:33 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.247.87.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.108
description:
2025-02-04 19:06:51 dovecot_plain authenticator failed for 111-70-3-108.emome-ip.hinet.net [111.70.3.108]:41581: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 220.149.87.198
domain: www.udesk.ait-ext.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/config/php.ini||User:aitext01||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-02-04 19:06:23 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:48773: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.247.87.75
description:
2025-02-04 19:06:35 dovecot_plain authenticator failed for ([132.247.87.75]) [132.247.87.75]:46539: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.108
description:
Feb  4 19:06:49 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.62.76.251
description:
[2025-02-04 19:06:48 +0100] info [webmaild] 92.62.76.251 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.26.86
description:
Feb  4 19:06:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.26.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.68.99.33
description:
Feb  4 19:07:01 ait sshd[100131]: pam_imunify(sshd:auth): [IM360_RBL] The IP 138.68.99.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 138.68.99.33
description:
Feb  4 19:07:01 ait sshd[100131]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=138.68.99.33


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Feb  4 19:06:21 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.26.86
description:
2025-02-04 19:07:01 dovecot_plain authenticator failed for ([65.76.26.86]) [65.76.26.86]:36908: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.77.15
description:
[2025-02-04 19:07:17 +0100] info [webmaild] 45.184.77.15 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.247.88
description:
Feb  4 19:08:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.247.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-02-04 19:08:07 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:38884: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.153.85.80
description:
[2025-02-04 19:07:14 +0100] info [webmaild] 197.153.85.80 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Feb  4 19:07:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-02-04 19:07:55 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:38044: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.10.44.126
description:
Feb  4 19:07:17 ait sshd[100180]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.10.44.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-02-04 19:07:54 dovecot_plain authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:18611: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 202.29.30.124
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:19-08.202.29.30.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.247.88
description:
2025-02-04 19:08:06 dovecot_plain authenticator failed for ([183.220.247.88]) [183.220.247.88]:58142: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.44.126
description:
Feb  4 19:07:17 ait sshd[100180]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.44.126


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.191.3.150
description:
[2025-02-04 19:07:50 +0100] info [webmaild] 132.191.3.150 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Feb  4 19:07:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
description:
Feb  4 19:08:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.36.67
description:
Feb  4 19:08:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.36.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
description:
2025-02-04 19:08:43 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:33284: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:19-08.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
description:
2025-02-04 19:08:15 dovecot_plain authenticator failed for ([121.128.76.110]) [211.196.31.2]:48524: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.6.16.137
description:
Feb  4 19:09:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.6.16.137 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.1.94
description:
[2025-02-04 19:09:59 +0100] info [webmaild] 181.78.1.94 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-02-04 19:10:03 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:49006: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
description:
Feb  4 19:09:15 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.62.46.15
description:
[2025-02-04 19:09:52 +0100] info [webmaild] 189.62.46.15 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Feb  4 19:09:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.132.167.110
description:
Feb  4 19:09:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.132.167.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Feb  4 19:09:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Feb  4 19:10:06 ait sshd[101498]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
description:
2025-02-04 19:09:17 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:42601: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Feb  4 19:09:40 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-02-04 19:09:59 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:43562: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.133.10.204
description:
Feb  4 19:09:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.133.10.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-02-04 19:09:41 dovecot_login authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:37316: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Feb  4 19:10:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Feb  4 19:09:29 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-02-04 19:09:37 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:36966: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-02-04 19:09:42 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:44400: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Feb  4 19:10:06 ait sshd[101498]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Feb  4 19:09:35 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.6.16.137
description:
2025-02-04 19:09:24 dovecot_plain authenticator failed for ([14.6.16.137]) [14.6.16.137]:50538: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.163.184.193
description:
[2025-02-04 19:09:26 +0100] info [webmaild] 78.163.184.193 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-02-04 19:09:31 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:4668: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Feb  4 19:09:39 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.132.167.110
description:
2025-02-04 19:09:41 dovecot_plain authenticator failed for ([222.132.167.110]) [222.132.167.110]:38725: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.10.27.190
description:
2025-02-04 19:10:08 dovecot_login authenticator failed for ([218.10.27.190]) [218.10.27.190]:37605: 535 Incorrect authentication data (set_id=nkansah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
description:
2025-02-04 19:09:24 dovecot_plain authenticator failed for ([61.133.10.205]) [61.133.10.204]:49702: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-02-04 19:10:24 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:17874: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.249.149
description:
[2025-02-04 19:10:28 +0100] info [webmaild] 177.185.249.149 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.32.227.248
description:
Feb  4 19:10:53 ait sshd[102035]: pam_imunify(sshd:auth): [IM360_RBL] The IP 187.32.227.248 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.76.250.194
description:
Feb  4 19:10:12 ait sshd[101734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.76.250.194


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.56.149.154
description:
Feb  4 19:11:09 ait sshd[102113]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.56.149.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.76.250.194
description:
Feb  4 19:10:12 ait sshd[101734]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.76.250.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Feb  4 19:10:22 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 187.32.227.248
description:
Feb  4 19:10:53 ait sshd[102035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=187.32.227.248


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.56.149.154
description:
Feb  4 19:11:09 ait sshd[102113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.56.149.154


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
description:
2025-02-04 19:10:18 dovecot_plain authenticator failed for ([116.104.50.190]) [116.104.50.190]:40308: 535 Incorrect authentication data


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.56.149.154
description:
Feb  4 19:11:11 ait sshd[102113]: Failed password for invalid user Can't open exe from 103.56.149.154 port 56462 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.100.136
description:
Feb  4 19:11:34 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.100.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Feb  4 19:11:36 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
description:
Feb  4 19:11:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.89.118
description:
Feb  4 19:11:45 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.89.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.109.253.156
description:
Feb  4 19:11:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.109.253.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.71.101
description:
Feb  4 19:11:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.71.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.206.105.37
description:
2025-02-04 19:11:20 dovecot_plain authenticator failed for ([10.13.105.93]) [195.206.105.37]:57624: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Feb  4 19:11:32 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-02-04 19:11:40 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (ering) [91.56.31.167]:61307: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-02-04 19:11:44 dovecot_plain authenticator failed for (mariold) [91.126.196.67]:34228: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-02-04 19:11:34 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:22112: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Feb  4 19:11:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
description:
2025-02-04 19:11:54 dovecot_plain authenticator failed for ([183.249.1.112]) [183.249.1.112]:34244: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.105.104.168
description:
Feb  4 19:12:05 ait sshd[102509]: pam_imunify(sshd:auth): [IM360_RBL] The IP 46.105.104.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.206.105.37
description:
Feb  4 19:11:18 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.206.105.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Feb  4 19:11:42 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.71.82
description:
Feb  4 19:11:44 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.71.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
description:
2025-02-04 19:11:46 dovecot_plain authenticator failed for ([182.76.71.82]) [182.76.71.82]:56794: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.105.104.168
description:
Feb  4 19:12:05 ait sshd[102509]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.105.104.168


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.109.253.156
description:
2025-02-04 19:11:59 dovecot_plain authenticator failed for ([172.109.253.156]) [172.109.253.156]:50820: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.71.101
description:
2025-02-04 19:12:01 dovecot_plain authenticator failed for ([82.208.71.101]) [82.208.71.101]:49410: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.112.191
description:
2025-02-04 19:11:43 dovecot_plain authenticator failed for ([223.95.112.191]) [223.95.112.191]:49470: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.204.109
description:
Feb  4 19:11:48 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.204.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.89.118
description:
2025-02-04 19:11:47 dovecot_plain authenticator failed for ([196.0.89.118]) [196.0.89.118]:56162: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
description:
Feb  4 19:11:52 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-02-04 19:11:55 dovecot_plain authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:59546: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Feb  4 19:11:38 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.112.191
description:
Feb  4 19:11:41 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.112.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
description:
2025-02-04 19:11:50 dovecot_plain authenticator failed for (ucicinemas.static.gvt.net.br) [186.215.204.109]:51197: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.41.211
description:
47.128.41.211 - - [04/Feb/2025:19:11:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4998327 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/5730cb?group=1&panel=db" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.41.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.237.100.136
description:
2025-02-04 19:11:36 dovecot_plain authenticator failed for ([103.237.100.136]) [103.237.100.136]:50316: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-02-04 19:11:38 dovecot_plain authenticator failed for ([189.6.78.182]) [189.6.78.182]:22722: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
description:
2025-02-04 19:11:44 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:39922: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.137.216.102
description:
[2025-02-04 19:12:09 +0100] info [webmaild] 179.137.216.102 - clients@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Feb  4 19:12:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-02-04 19:12:57 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:52920: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-02-04 19:13:04 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:32996: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-02-04 19:13:05 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:57122: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-02-04 19:12:55 dovecot_plain authenticator failed for 95-87-225-236.ip.btc-net.bg (95-87-225-236.net1.bg) [95.87.225.236]:57486: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Feb  4 19:13:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-02-04 19:13:05 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:59124: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.121.193.191
description:
2025-02-04 19:13:10 dovecot_plain authenticator failed for syn-070-121-193-191.res.spectrum.com [70.121.193.191]:17597: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Feb  4 19:12:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.75.165
description:
[2025-02-04 19:12:38 +0100] info [webmaild] 45.186.75.165 - clients@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Feb  4 19:13:06 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Feb  4 19:12:37 ait sshd[102644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Feb  4 19:13:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.20.197
description:
Feb  4 19:13:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.20.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-02-04 19:13:00 dovecot_plain authenticator failed for ([202.200.14.2]) [202.200.14.2]:51332: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
description:
2025-02-04 19:13:05 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:56914: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-02-04 19:13:10 dovecot_plain authenticator failed for ([1.28.192.118]) [1.28.192.118]:37245: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.20.197
description:
2025-02-04 19:13:10 dovecot_plain authenticator failed for ([65.76.20.197]) [65.76.20.197]:42502: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-02-04 19:13:10 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:44060: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-02-04 19:13:01 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:59201: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.112.45.222
description:
2025-02-04 19:13:01 dovecot_plain authenticator failed for ([124.112.45.222]) [124.112.45.222]:42901: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-02-04 19:13:09 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:53481: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.180.93.208
description:
Feb  4 19:12:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.180.93.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.55.177.39
description:
2025-02-04 19:13:03 dovecot_plain authenticator failed for ([218.55.177.39]) [218.55.177.39]:46476: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.55.177.39
description:
Feb  4 19:13:01 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.55.177.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.25.205
description:
2025-02-04 19:12:59 dovecot_plain authenticator failed for 111-70-25-205.emome-ip.hinet.net [111.70.25.205]:36917: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Feb  4 19:13:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
description:
2025-02-04 19:13:05 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:39894: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.229.118.208
description:
Feb  4 19:12:57 ait sshd[102901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.229.118.208


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.218
description:
Feb  4 19:12:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.85.69.22
description:
2025-02-04 19:12:56 dovecot_plain authenticator failed for ([194.85.69.22]) [194.85.69.22]:58722: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-02-04 19:12:58 dovecot_plain authenticator failed for ([103.124.54.14]) [103.124.54.14]:38728: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Feb  4 19:13:09 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.9.222
description:
Feb  4 19:12:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.9.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
description:
2025-02-04 19:12:56 dovecot_plain authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:57810: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.66.190.67
description:
2025-02-04 19:12:57 dovecot_plain authenticator failed for ([116.66.190.67]) [116.66.190.67]:53174: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-02-04 19:13:05 dovecot_plain authenticator failed for ([177.6.235.62]) [177.6.235.62]:43305: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
description:
2025-02-04 19:12:56 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:49156: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.58.25
description:
Feb  4 19:13:00 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.58.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
description:
Feb  4 19:13:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Feb  4 19:13:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-02-04 19:12:57 dovecot_plain authenticator failed for (78-168-168-45.weblinknet.com.br) [45.168.168.78]:58675: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.180.102
description:
2025-02-04 19:12:55 dovecot_plain authenticator failed for 80-15-180-102.ftth.fr.orangecustomers.net [80.15.180.102]:34660: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Feb  4 19:13:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.68.116
description:
Feb  4 19:13:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.68.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.125
description:
2025-02-04 19:13:04 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.125]:47748: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Feb  4 19:13:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
description:
Feb  4 19:12:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-02-04 19:13:01 dovecot_plain authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:21730: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.161.16.240
description:
Feb  4 19:13:07 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.161.16.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-02-04 19:13:08 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:34247: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Feb  4 19:13:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Feb  4 19:12:37 ait sshd[102644]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.232
description:
2025-02-04 19:13:07 dovecot_plain authenticator failed for (abts-ap-dynamic-232.205.169.122.airtelbroadband.in) [122.169.205.232]:44730: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.119.194.70
description:
2025-02-04 19:13:08 dovecot_plain authenticator failed for ([212.119.194.70]) [212.119.194.70]:34190: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.17
description:
Feb  4 19:12:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-02-04 19:13:06 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:57804: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.48.197
description:
Feb  4 19:12:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.48.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Feb  4 19:12:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.125
description:
Feb  4 19:13:02 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Feb  4 19:12:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-02-04 19:12:56 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:41566: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.17
description:
2025-02-04 19:12:59 dovecot_plain authenticator failed for 111-70-19-17.emome-ip.hinet.net [111.70.19.17]:60395: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-02-04 19:12:59 dovecot_plain authenticator failed for ([112.111.61.229]) [112.111.61.229]:60962: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Feb  4 19:13:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.48.197
description:
2025-02-04 19:12:57 dovecot_plain authenticator failed for ([103.172.48.197]) [103.172.48.197]:36721: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.94.17
description:
[2025-02-04 19:13:10 +0100] info [webmaild] 37.238.94.17 - clients@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.66.190.67
description:
Feb  4 19:12:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.66.190.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.246.141
description:
Feb  4 19:12:56 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.246.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.71.58.25
description:
2025-02-04 19:13:02 dovecot_plain authenticator failed for ([45.71.58.25]) [45.71.58.25]:56465: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.180.102
description:
Feb  4 19:12:53 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.180.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.235.148.73
description:
Feb  4 19:12:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.235.148.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.205.218
description:
2025-02-04 19:12:57 dovecot_plain authenticator failed for ([122.169.205.218]) [122.169.205.218]:51774: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Feb  4 19:12:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.235.148.73
description:
2025-02-04 19:12:59 dovecot_plain authenticator failed for ([171.235.148.73]) [171.235.148.73]:56832: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
description:
Feb  4 19:13:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Feb  4 19:13:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.125.68.208
description:
2025-02-04 19:13:07 dovecot_plain authenticator failed for ([175.125.68.208]) [175.125.68.208]:38440: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Feb  4 19:12:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.161.26
description:
2025-02-04 19:13:05 dovecot_plain authenticator failed for ([223.95.161.26]) [223.95.161.26]:53500: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
description:
Feb  4 19:12:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.9.222
description:
2025-02-04 19:12:55 dovecot_plain authenticator failed for ([31.173.9.222]) [31.173.9.222]:33148: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.235.246
description:
Feb  4 19:12:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.235.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 38.123.220.10
description:
Feb  4 19:12:46 ait sshd[102689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=38.123.220.10


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-02-04 19:13:06 dovecot_plain authenticator failed for ([210.206.24.238]) [210.206.24.234]:44162: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.112.45.222
description:
Feb  4 19:12:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.112.45.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.121.193.191
description:
Feb  4 19:13:08 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.121.193.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Feb  4 19:12:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Feb  4 19:13:04 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-02-04 19:13:09 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:59370: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.161.26
description:
Feb  4 19:13:03 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.161.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-02-04 19:13:00 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:57064: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-02-04 19:13:05 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:52956: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.25.205
description:
Feb  4 19:12:57 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.25.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Feb  4 19:12:55 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Feb  4 19:12:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Feb  4 19:12:59 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.68.208
description:
Feb  4 19:13:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.125.68.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.123.220.10
description:
Feb  4 19:12:46 ait sshd[102689]: pam_imunify(sshd:auth): [IM360_RBL] The IP 38.123.220.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Feb  4 19:12:58 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.180.93.208
description:
2025-02-04 19:12:59 dovecot_plain authenticator failed for ([182.180.93.208]) [182.180.93.208]:55174: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-02-04 19:12:56 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:55942: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.85.69.22
description:
Feb  4 19:12:54 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.85.69.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.235.246
description:
2025-02-04 19:12:56 dovecot_plain authenticator failed for h77-53-235-246.cust.bredband2.com [77.53.235.246]:42792: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.246.141
description:
2025-02-04 19:12:58 dovecot_plain authenticator failed for ([94.204.246.141]) [94.204.246.141]:33145: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.205.232
description:
Feb  4 19:13:05 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.205.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
description:
2025-02-04 19:13:09 dovecot_plain authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:53378: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.228.182.216
description:
[2025-02-04 19:12:34 +0100] info [webmaild] 177.228.182.216 - clients@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
description:
Feb  4 19:13:14 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.208.245
description:
Feb  4 19:13:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.208.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Feb  4 19:13:11 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
description:
Feb  4 19:13:12 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.39.128
description:
Feb  4 19:13:24 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.39.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.220.112
description:
Feb  4 19:13:26 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.220.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.127
description:
2025-02-04 19:13:31 dovecot_plain authenticator failed for (m121-202-154-127.smartone.com) [121.202.154.127]:52868: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-02-04 19:13:12 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:62775: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.192.247.84
description:
Feb  4 19:13:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.192.247.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Feb  4 19:13:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Feb  4 19:13:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
description:
Feb  4 19:13:20 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.135
description:
Feb  4 19:13:16 ait auth[4041475]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.135 has been locked due to Imunify RBL


