# incident

plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 30 05:55:27 ait sshd[707556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 05:55:27 ait sshd[707556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:54:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.235.61
description:
[2025-01-30 05:55:08 +0100] info [webmaild] 177.126.235.61 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-55.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.212.38.130
description:
Jan 30 05:56:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.212.38.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.212.38.130
description:
2025-01-30 05:56:11 dovecot_plain authenticator failed for (130.38.212.118.adsl-pool.jx.chinaunicom.com) [118.212.38.130]:48152: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.148.10.71
domain: www.a-rapp.ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/titlemas/public_html/a-rapp.ait-edu.us/wp-admin/images/index.php


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 05:56:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
description:
2025-01-30 05:56:33 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:56740: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Jan 30 05:55:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.133.25.179
description:
[2025-01-30 05:56:00 +0100] info [webmaild] 190.133.25.179 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-01-30 05:55:53 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:50806: 535 Incorrect authentication data (set_id=assdas4)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 45.148.10.71
domain: www.a-rapp.ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:05-56.45.148.10.71||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Jan 30 05:56:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 30 05:55:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-30 05:55:41 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:36110: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-01-30 05:56:44 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:64708: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:56:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 30 05:57:18 ait sshd[708145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Jan 30 05:56:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 30 05:57:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-30 05:57:02 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:34872: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.88.96.37
description:
2025-01-30 05:58:37 dovecot_plain authenticator failed for ([58.131.97.5]) [180.88.96.37]:4205: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 05:57:45 ait sshd[708214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.88.96.37
description:
Jan 30 05:58:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.88.96.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 05:57:45 ait sshd[708214]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.221.201.75
description:
[2025-01-30 05:58:19 +0100] info [webmaild] 179.221.201.75 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 05:58:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.146.229.94
description:
[2025-01-30 05:59:06 +0100] info [webmaild] 197.146.229.94 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.227
description:
Jan 30 05:59:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.227
description:
2025-01-30 05:59:19 dovecot_plain authenticator failed for 227.42.246.220.static.netvigator.com [220.246.42.227]:65318: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.112.6.186
description:
2025-01-30 05:59:30 dovecot_plain authenticator failed for ([116.112.6.186]) [116.112.6.186]:52683: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.91.107.199
description:
[2025-01-30 05:59:38 +0100] info [cpaneld] 138.91.107.199 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Jan 30 05:58:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-01-30 05:58:46 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:35725: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.39.152.121
description:
[2025-01-30 05:59:06 +0100] info [webmaild] 187.39.152.121 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.112.6.186
description:
Jan 30 05:59:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.112.6.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 05:59:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.151.89
description:
[2025-01-30 05:59:58 +0100] info [webmaild] 186.224.151.89 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.38.100
description:
47.128.38.100 - - [30/Jan/2025:06:00:15 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16873349 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/12/?duration=short&filter_course-language=183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.38.100


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.193.106.140
description:
Jan 30 06:01:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.193.106.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.12.68.242
description:
Jan 30 06:01:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.12.68.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.12.68.242
description:
2025-01-30 06:01:16 dovecot_plain authenticator failed for ([210.12.68.242]) [210.12.68.242]:38730: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.193.106.140
description:
2025-01-30 06:01:27 dovecot_plain authenticator failed for ([122.193.106.140]) [122.193.106.140]:37287: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.101.44.224
description:
[2025-01-30 06:02:09 +0100] info [webmaild] 177.101.44.224 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.41.7.80
description:
[2025-01-30 06:02:58 +0100] info [webmaild] 179.41.7.80 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:03:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.152.95.166
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:masomani@ait.edu.gh||WPU:masomani@ait.edu.gh||RSV:6.65||T:APACHE||MV:06-03.185.152.95.166


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.33.13
description:
47.128.33.13 - - [30/Jan/2025:06:03:33 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=2544292 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?duration=short&filter_course-language=120&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.33.13


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.88.87
description:
[2025-01-30 06:02:58 +0100] info [webmaild] 157.100.88.87 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Jan 30 06:04:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 122.152.55.65
description:
[2025-01-30 06:03:50 +0100] info [webmaild] 122.152.55.65 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.197
description:
2025-01-30 06:04:32 dovecot_plain authenticator failed for (nlos-200-197.zamnet.zm) [196.46.200.197]:57792: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.190.87
description:
Jan 30 06:04:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.190.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.190.87
description:
2025-01-30 06:04:36 dovecot_login authenticator failed for ([180.7.190.87]) [180.7.190.87]:51832: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 30 06:04:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-30 06:04:19 dovecot_login authenticator failed for (13-78-123-185.host.cirex.ru) [185.123.78.13]:10747: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.197
description:
Jan 30 06:04:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-30 06:05:33 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:53747: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-01-30 06:04:40 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:50657: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Jan 30 06:04:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.33.36.254
description:
Jan 30 06:05:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.33.36.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 30 06:05:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.33.36.254
description:
2025-01-30 06:05:22 dovecot_plain authenticator failed for ([102.33.36.254]) [102.33.36.254]:35125: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 30 06:05:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-01-30 06:04:51 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:51120: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-30 06:05:10 dovecot_plain authenticator failed for ([46.30.161.197]) [46.30.161.197]:38457: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:06:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.66.72.131
description:
Jan 30 06:06:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.66.72.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.66.72.131
description:
2025-01-30 06:06:28 dovecot_login authenticator failed for ([127.0.0.1]) [178.66.72.131]:53045: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.132.7.7
description:
2025-01-30 06:06:36 dovecot_login authenticator failed for ([127.0.0.1]) [201.132.7.7]:40545: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.176.64
description:
[2025-01-30 06:05:57 +0100] info [webmaild] 45.165.176.64 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.132.7.7
description:
Jan 30 06:06:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.132.7.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.121.110
description:
2025-01-30 06:06:44 dovecot_plain authenticator failed for ([46.29.121.110]) [46.29.121.110]:46388: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
description:
Jan 30 06:06:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
description:
2025-01-30 06:06:56 dovecot_plain authenticator failed for ([103.59.134.177]) [103.59.134.177]:5299: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.202.144
description:
[2025-01-30 06:07:05 +0100] info [webmaild] 45.4.202.144 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.29.121.110
description:
Jan 30 06:06:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.29.121.110 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.196.140.109
description:
[2025-01-30 06:06:45 +0100] info [webmaild] 200.196.140.109 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.241.247.150
description:
Jan 30 06:07:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.241.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.247.150
description:
2025-01-30 06:07:32 dovecot_plain authenticator failed for ([191.241.247.150]) [191.241.247.150]:49228: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-08.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 06:07:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.90.34
description:
2025-01-30 06:07:43 dovecot_plain authenticator failed for ([154.127.90.34]) [154.127.90.34]:41027: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.189.225.136
description:
[2025-01-30 06:07:57 +0100] info [webmaild] 45.189.225.136 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.90.34
description:
Jan 30 06:07:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.90.34 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 30 06:08:52 ait sshd[712673]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.27.155.31
description:
[2025-01-30 06:10:00 +0100] info [webmaild] 186.27.155.31 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 30 06:10:29 ait sshd[713449]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.44.76.103
description:
Jan 30 06:10:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.44.76.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.44.76.103
description:
2025-01-30 06:10:37 dovecot_login authenticator failed for 207.44.76.103.res-cmts.hol.ptd.net [207.44.76.103]:56320: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 30 06:10:29 ait sshd[713449]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 06:10:32 dovecot_plain authenticator failed for (metys) [207.188.157.230]:23043: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 06:10:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.122.48.91
description:
Jan 30 06:10:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.122.48.91 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.189.112.89
description:
[2025-01-30 06:10:56 +0100] info [webmaild] 191.189.112.89 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 06:11:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Jan 30 06:11:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-01-30 06:11:34 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:49672: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.141.195.8
description:
[2025-01-30 06:10:48 +0100] info [webmaild] 192.141.195.8 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.122.48.91
description:
2025-01-30 06:10:50 dovecot_login authenticator failed for ([124.206.196.124]) [123.122.48.91]:36931: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:11:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.181.210.98
description:
Jan 30 06:11:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.181.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.181.210.98
description:
2025-01-30 06:11:47 dovecot_plain authenticator failed for ([221.181.210.98]) [221.181.210.98]:41019: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.105.83
description:
[2025-01-30 06:11:49 +0100] info [webmaild] 45.187.105.83 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:12:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.179.255.54
description:
2025-01-30 06:12:56 dovecot_plain authenticator failed for ([220.179.255.54]) [220.179.255.54]:33579: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 30 06:13:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-30 06:13:09 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:60422: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 06:12:54 ait sshd[713952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 06:12:54 ait sshd[713952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
description:
Jan 30 06:12:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:12:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.213.200.181
description:
[2025-01-30 06:14:08 +0100] info [webmaild] 186.213.200.181 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:14:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 06:14:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 192.141.194.141
description:
[2025-01-30 06:14:51 +0100] info [webmaild] 192.141.194.141 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.229.83.18
description:
[2025-01-30 06:14:57 +0100] info [webmaild] 103.229.83.18 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.107.67
description:
2025-01-30 06:16:02 dovecot_plain authenticator failed for v2202409233646285895.ultrasrv.de (catrabst) [152.53.107.67]:56542: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.17.13
description:
47.128.17.13 - - [30/Jan/2025:06:16:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19633406 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30%2C125%2C106&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.17.13


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.130.2
description:
2025-01-30 06:15:59 dovecot_login authenticator failed for ([127.0.0.1]) [78.36.130.2]:42225: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-01-30 06:16:20 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:37171: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.64.9
description:
[2025-01-30 06:15:45 +0100] info [webmaild] 157.100.64.9 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.107.67
description:
Jan 30 06:16:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.107.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-01-30 06:16:29 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:37560: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.99.242.32
description:
Jan 30 06:16:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.99.242.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.99.242.32
description:
2025-01-30 06:16:13 dovecot_login authenticator failed for ([127.0.0.1]) [125.99.242.32]:58159: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Jan 30 06:16:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.80.65.214
description:
Jan 30 06:16:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.80.65.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.36.130.2
description:
Jan 30 06:15:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.36.130.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-30 06:17:12 dovecot_plain authenticator failed for (emanicome) [93.159.152.6]:43174: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.123.128.195
description:
Jan 30 06:17:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.123.128.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 06:16:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 44.211.191.117
description:
2025-01-30 06:17:26 dovecot_login authenticator failed for ec2-44-211-191-117.compute-1.amazonaws.com ([127.0.0.1]) [44.211.191.117]:57898: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 30 06:17:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 44.211.191.117
description:
Jan 30 06:17:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 44.211.191.117 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 06:18:31 ait sshd[715991]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.166.206.176
description:
[2025-01-30 06:18:43 +0100] info [webmaild] 45.166.206.176 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.79.154
description:
[2025-01-30 06:18:53 +0100] info [webmaild] 131.161.79.154 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 06:18:31 ait sshd[715991]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-30 06:19:48 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (xythi) [91.200.226.218]:57124: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.173
description:
47.128.99.173 - - [30/Jan/2025:06:20:04 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16325325 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=118%2C121%2C198&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 06:19:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 30 06:19:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.137.231.241
description:
[2025-01-30 06:19:47 +0100] info [webmaild] 103.137.231.241 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 06:19:45 dovecot_plain authenticator failed for (myolly) [81.211.77.58]:42201: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.252.177
description:
Jan 30 06:20:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.252.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.252.177
description:
2025-01-30 06:20:25 dovecot_plain authenticator failed for ([117.4.252.177]) [117.4.252.177]:57423: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 30 06:20:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-30 06:20:48 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:45179: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 30 06:21:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-30 06:21:05 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (wegroses) [51.255.84.180]:38470: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-21.15.206.171.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.106.129.175
description:
[2025-01-30 06:21:51 +0100] info [webmaild] 200.106.129.175 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.99.40
description:
47.128.99.40 - - [30/Jan/2025:06:22:39 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20058506 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=30%2C125&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.99.40


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Jan 30 06:22:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-01-30 06:22:45 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:46892: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.95.169.49
description:
[2025-01-30 06:22:49 +0100] info [webmaild] 187.95.169.49 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 30 06:22:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-30 06:22:34 dovecot_plain authenticator failed for ([220.178.246.43]) [220.178.246.43]:48251: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.210.9
description:
[2025-01-30 06:22:39 +0100] info [webmaild] 187.108.210.9 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Jan 30 06:23:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-01-30 06:23:14 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:50668: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.50.48.86
description:
Jan 30 06:23:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.50.48.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 30 06:23:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.64.128
description:
2025-01-30 06:24:07 dovecot_plain authenticator failed for ([61.2.64.128]) [61.2.64.128]:42240: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.50.48.86
description:
2025-01-30 06:23:36 dovecot_plain authenticator failed for ([212.50.48.86]) [212.50.48.86]:39998: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-30 06:23:37 dovecot_plain authenticator failed for (arousande) [102.53.15.17]:56445: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.130.10
description:
[2025-01-30 06:23:41 +0100] info [webmaild] 177.200.130.10 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.64.128
description:
Jan 30 06:24:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.64.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-01-30 06:25:06 dovecot_login authenticator failed for ([127.0.0.1]) [102.215.188.37]:34504: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:24:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 06:24:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Jan 30 06:24:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-01-30 06:24:32 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:35868: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.132.125.226
description:
Jan 30 06:24:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.132.125.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-01-30 06:24:59 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:50094: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 06:26:07 ait sshd[718495]: Invalid user art-of-contour.de 2a12 from 122.51.104.242 port 41052


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 30 06:26:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 06:26:07 ait sshd[718495]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 30 06:25:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-30 06:25:12 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:50693: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.6.81.59
description:
Jan 30 06:25:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.6.81.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
description:
2025-01-30 06:25:15 dovecot_plain authenticator failed for bb121-6-81-59.singnet.com.sg [121.6.81.59]:52988: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.135.171
description:
[2025-01-30 06:25:45 +0100] info [webmaild] 177.131.135.171 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 06:26:24 ait sshd[718647]: Invalid user art-of-contour.de 2a12 from 122.51.104.242 port 57132


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.123.225.216
description:
[2025-01-30 06:26:33 +0100] info [webmaild] 200.123.225.216 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 30 06:26:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.15.105
description:
Jan 30 06:26:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.15.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.135.181.49
description:
[2025-01-30 06:27:06 +0100] info [webmaild] 185.135.181.49 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.100.248.64
description:
Jan 30 06:26:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.100.248.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
description:
2025-01-30 06:26:21 dovecot_plain authenticator failed for ([223.100.248.64]) [223.100.248.64]:48355: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 06:26:24 ait sshd[718647]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-30 06:26:36 dovecot_plain authenticator failed for ([211.105.223.49]) [211.105.223.49]:52150: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.15.105
description:
2025-01-30 06:26:42 dovecot_login authenticator failed for ([186.200.123.85]) [201.63.15.105]:42904: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 30 06:27:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-30 06:27:05 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:40470: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 06:27:10 ait sshd[718751]: Invalid user art-of-contour.de 2a12 from 122.51.104.242 port 41122


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.181.33.228
description:
[2025-01-30 06:27:58 +0100] info [webmaild] 45.181.33.228 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 06:27:10 ait sshd[718751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:28:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.235.25.35
description:
2025-01-30 06:28:48 dovecot_login authenticator failed for ([127.0.0.1]) [77.235.25.35]:49423: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.250
description:
47.128.123.250 - - [30/Jan/2025:06:28:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9847727 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/13/?filter_course-language=121%2C183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.250


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.7.153
description:
Jan 30 06:28:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.7.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.235.25.35
description:
Jan 30 06:28:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.235.25.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.7.153
description:
2025-01-30 06:28:47 dovecot_login authenticator failed for ([119.207.7.153]) [119.207.7.153]:36947: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-30 06:28:51 dovecot_plain authenticator failed for ([1.193.163.2]) [1.193.163.2]:46195: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.155.8.109
description:
2025-01-30 06:29:03 dovecot_login authenticator failed for 109.sub-166-155-8.myvzw.com [166.155.8.109]:49498: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.90.108.46
description:
Jan 30 06:29:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.90.108.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.123.128.195
description:
Jan 30 06:28:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.123.128.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 06:28:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.123.128.195
description:
2025-01-30 06:28:41 dovecot_login authenticator failed for ([127.0.0.1]) [175.123.128.195]:51166: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 30 06:28:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.155.8.109
description:
Jan 30 06:29:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.155.8.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.90.108.46
description:
2025-01-30 06:29:07 dovecot_plain authenticator failed for ([212.90.108.46]) [212.90.108.46]:53987: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.46.175.163
description:
[2025-01-30 06:30:07 +0100] info [webmaild] 77.46.175.163 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 06:29:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 30 06:30:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-30 06:30:52 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:46804: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-01-30 06:30:39 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:59302: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Jan 30 06:30:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 61.6.194.92
description:
[2025-01-30 06:30:53 +0100] info [webmaild] 61.6.194.92 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.163.1
description:
[2025-01-30 06:30:55 +0100] info [webmaild] 168.232.163.1 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.87.86
description:
2025-01-30 06:31:58 dovecot_plain authenticator failed for (187-93-87-86.customer.tdatabrasil.net.br) [187.93.87.86]:45531: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.157.130.199
description:
[2025-01-30 06:31:44 +0100] info [webmaild] 132.157.130.199 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.87.86
description:
Jan 30 06:31:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.87.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.154
description:
Jan 30 06:31:59 ait sshd[720687]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-01-30 06:32:05 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:45013: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
description:
Jan 30 06:31:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
description:
2025-01-30 06:31:43 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:47133: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-30 06:31:52 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:59550: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.154
description:
Jan 30 06:31:59 ait sshd[720687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.154  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.222.167.128
description:
[2025-01-30 06:31:45 +0100] info [webmaild] 177.222.167.128 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Jan 30 06:31:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Jan 30 06:32:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
description:
Jan 30 06:32:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.53
description:
Jan 30 06:33:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.53
description:
2025-01-30 06:33:06 dovecot_plain authenticator failed for ([207.219.221.53]) [207.219.221.53]:44281: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
description:
2025-01-30 06:32:51 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:54888: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.154
description:
Jan 30 06:33:24 ait sshd[720957]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.154 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.154
description:
Jan 30 06:33:24 ait sshd[720957]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.154  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.72.19
description:
[2025-01-30 06:33:54 +0100] info [webmaild] 213.230.72.19 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.144.125
description:
Jan 30 06:33:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.144.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.144.125
description:
2025-01-30 06:33:16 dovecot_login authenticator failed for ([127.0.0.1]) [219.157.144.125]:40505: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.123.74
description:
2025-01-30 06:33:26 dovecot_login authenticator failed for ([127.0.0.1]) [202.4.123.74]:58754: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.123.74
description:
Jan 30 06:33:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.123.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 30 06:34:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-30 06:34:46 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:25060: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.59.64
description:
[2025-01-30 06:34:49 +0100] info [webmaild] 170.0.59.64 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.48.14
description:
47.128.48.14 - - [30/Jan/2025:06:34:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20179087 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/aaf8f9?panel=time" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.48.14


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.185.218.77
description:
[2025-01-30 06:34:43 +0100] info [webmaild] 191.185.218.77 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Jan 30 06:34:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-30 06:34:54 dovecot_login authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:42729: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-35.15.206.171.64


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.122.179.118
description:
Jan 30 06:36:06 ait sshd[722111]: pam_imunify(sshd:auth): [IM360_RBL] The IP 222.122.179.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.84.81.131
description:
[2025-01-30 06:35:44 +0100] info [webmaild] 206.84.81.131 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.122.179.118
description:
Jan 30 06:36:06 ait sshd[722111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.122.179.118  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 30 06:37:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 30 06:37:06 ait sshd[722423]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-30 06:37:05 dovecot_plain authenticator failed for ([222.120.176.6]) [222.120.176.6]:54102: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 30 06:37:06 ait sshd[722423]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.25.253.114
description:
[2025-01-30 06:38:00 +0100] info [webmaild] 223.25.253.114 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 30 06:37:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-30 06:37:16 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:30686: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.78
description:
2025-01-30 06:37:29 dovecot_login authenticator failed for (uM489EpLi) [141.98.10.78]:56970: 535 Incorrect authentication data (set_id=open)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 30 06:37:57 ait sshd[722704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-30 06:38:18 dovecot_plain authenticator failed for (photipyla) [109.166.70.166]:59833: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.23.31
description:
[2025-01-30 06:38:40 +0100] info [webmaild] 45.231.23.31 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.198.194.27
description:
[2025-01-30 06:38:46 +0100] info [webmaild] 46.198.194.27 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.78
description:
2025-01-30 06:38:14 dovecot_login authenticator failed for (l6fJdrW6NR) [141.98.10.78]:50987: 535 Incorrect authentication data (set_id=open)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 30 06:38:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.60.154
description:
Jan 30 06:39:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.60.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Jan 30 06:39:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-01-30 06:39:21 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:50860: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.168.98
description:
[2025-01-30 06:39:31 +0100] info [webmaild] 181.191.168.98 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.60.154
description:
2025-01-30 06:39:36 dovecot_plain authenticator failed for ([220.172.60.154]) [220.172.60.154]:59261: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.196.6
description:
Jan 30 06:41:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.196.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 06:40:50 ait sshd[724279]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
description:
Jan 30 06:41:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.164.253.45
description:
Jan 30 06:41:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.164.253.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
description:
2025-01-30 06:41:30 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:45628: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.164.253.45
description:
2025-01-30 06:41:31 dovecot_login authenticator failed for ti0040a400-0553.bb.online.no ([127.0.0.1]) [85.164.253.45]:38097: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-01-30 06:41:59 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:50258: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.250.226
description:
Jan 30 06:41:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.250.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.250.226
description:
2025-01-30 06:41:37 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.250.226]:59304: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Jan 30 06:41:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.196.6
description:
2025-01-30 06:41:09 dovecot_plain authenticator failed for ([121.202.196.6]) [121.202.196.6]:51763: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 06:41:41 ait sshd[724562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 207.204.103.95
description:
[2025-01-30 06:41:53 +0100] info [webmaild] 207.204.103.95 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.190
description:
Jan 30 06:42:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.190
description:
2025-01-30 06:42:20 dovecot_plain authenticator failed for ([122.187.229.190]) [122.187.229.190]:46837: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.86.170
description:
[2025-01-30 06:42:32 +0100] info [webmaild] 84.54.86.170 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.19.123.101
description:
[2025-01-30 06:42:44 +0100] info [webmaild] 186.19.123.101 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.85.183.88
description:
Jan 30 06:43:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.85.183.88 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 30 06:43:59 ait sshd[725192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Jan 30 06:44:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-01-30 06:44:04 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:53180: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.122.152.227
description:
[2025-01-30 06:43:24 +0100] info [webmaild] 37.122.152.227 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.98.157
description:
2025-01-30 06:43:55 dovecot_plain authenticator failed for ([222.119.98.157]) [222.119.98.157]:38193: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.85.183.88
description:
2025-01-30 06:43:10 dovecot_plain authenticator failed for a88.sub183.net78.udm.net (unforagged) [78.85.183.88]:59477: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.98.157
description:
Jan 30 06:43:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.98.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-01-30 06:44:23 dovecot_login authenticator failed for ([82.204.162.116]) [82.204.162.116]:50274: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 06:44:08 ait sshd[725353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-30 06:44:13 dovecot_login authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:33950: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Jan 30 06:44:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-01-30 06:44:25 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:63996: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 30 06:44:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Jan 30 06:44:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.162.46.212
description:
Jan 30 06:46:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.162.46.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:46:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.162.46.212
description:
2025-01-30 06:46:08 dovecot_login authenticator failed for ([127.0.0.1]) [14.162.46.212]:46874: 535 Incorrect authentication data (set_id=eng15a00111y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 06:45:58 ait sshd[726087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.21.174.234
description:
2025-01-30 06:45:59 dovecot_login authenticator failed for ([127.0.0.1]) [199.21.174.234]:45260: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Jan 30 06:45:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 30 06:45:58 ait sshd[726087]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.68.212.55
description:
[2025-01-30 06:45:50 +0100] info [webmaild] 186.68.212.55 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.135.208
description:
Jan 30 06:46:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.135.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.135.208
description:
2025-01-30 06:46:08 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:54540: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.21.174.234
description:
Jan 30 06:45:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.21.174.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-01-30 06:45:57 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:29442: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.191.16.161
description:
[2025-01-30 06:46:56 +0100] info [webmaild] 187.191.16.161 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.42.1
description:
[2025-01-30 06:46:37 +0100] info [webmaild] 45.230.42.1 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.77.21.39
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:06-46.51.77.21.39


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.75.51
description:
[2025-01-30 06:47:48 +0100] info [webmaild] 45.176.75.51 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-48.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 30 06:49:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Jan 30 06:48:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-30 06:49:03 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:1028: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.215
description:
Jan 30 06:49:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.248.243.181
description:
Jan 30 06:49:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.248.243.181 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.189
description:
Jan 30 06:48:52 ait sshd[727107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.189


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-01-30 06:48:59 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:53914: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.215
description:
2025-01-30 06:49:06 dovecot_plain authenticator failed for ([67.55.189.215]) [67.55.189.215]:51922: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
description:
Jan 30 06:49:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.189
description:
Jan 30 06:48:52 ait sshd[727107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Jan 30 06:50:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
description:
2025-01-30 06:49:10 dovecot_plain authenticator failed for (avels) [41.248.243.181]:40512: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.238
description:
2025-01-30 06:49:35 dovecot_plain authenticator failed for 111-70-23-238.emome-ip.hinet.net [111.70.23.238]:33806: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.77.220.62
description:
Jan 30 06:49:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.77.220.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 30 06:49:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-30 06:49:41 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:36150: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.33.162
description:
Jan 30 06:49:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.33.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.33.162
description:
2025-01-30 06:50:00 dovecot_login authenticator failed for ([183.237.33.162]) [183.237.33.162]:1960: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-01-30 06:49:12 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:38458: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.98.134
description:
Jan 30 06:49:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-01-30 06:50:07 dovecot_plain authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:56930: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.77.220.62
description:
2025-01-30 06:49:31 dovecot_plain authenticator failed for ([61.77.220.62]) [61.77.220.62]:56722: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.178.65.35
description:
[2025-01-30 06:49:39 +0100] info [webmaild] 196.178.65.35 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Jan 30 06:49:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-30 06:49:12 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:34136: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.98.134
description:
2025-01-30 06:49:22 dovecot_plain authenticator failed for ([138.75.98.134]) [138.75.98.134]:32973: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.238
description:
Jan 30 06:49:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-01-30 06:49:10 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:54682: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 30 06:49:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.215.5.46
description:
[2025-01-30 06:50:28 +0100] info [webmaild] 37.215.5.46 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:50:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.130.131
description:
[2025-01-30 06:50:51 +0100] info [webmaild] 168.196.130.131 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.229
description:
Jan 30 06:50:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.229
description:
2025-01-30 06:50:13 dovecot_login authenticator failed for ([196.189.124.229]) [196.189.124.229]:35088: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.152.225.154
description:
Jan 30 06:50:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.152.225.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
description:
2025-01-30 06:50:17 dovecot_plain authenticator failed for s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:4811: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.16.156.103
description:
Jan 30 06:51:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.16.156.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.16.156.103
description:
2025-01-30 06:51:33 dovecot_login authenticator failed for (173-16-156-103.client.mchsi.com) [173.16.156.103]:38090: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.248.64.227
description:
[2025-01-30 06:51:43 +0100] info [webmaild] 5.248.64.227 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.216.2.74
description:
Jan 30 06:51:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.216.2.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.216.2.74
description:
2025-01-30 06:51:56 dovecot_login authenticator failed for ([222.216.2.74]) [222.216.2.74]:46092: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 128.201.98.68
description:
[2025-01-30 06:53:28 +0100] info [webmaild] 128.201.98.68 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 06:53:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:53:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 06:53:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 171.244.129.243
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:06-53.171.244.129.243


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 06:54:23 ait sshd[729478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:55:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.198.133.91
description:
[2025-01-30 06:54:49 +0100] info [webmaild] 103.198.133.91 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.20.85.186
description:
[2025-01-30 06:54:16 +0100] info [webmaild] 187.20.85.186 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 06:54:23 ait sshd[729478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-55.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.132.172
description:
[2025-01-30 06:55:40 +0100] info [webmaild] 160.238.132.172 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.150
description:
2025-01-30 06:57:28 dovecot_plain authenticator failed for (nsg-corporate-150.230.187.122.airtel.in) [122.187.230.150]:58625: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.180.189
description:
[2025-01-30 06:57:37 +0100] info [webmaild] 177.124.180.189 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 30 06:57:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-30 06:57:39 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:54774: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:57:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.150
description:
Jan 30 06:57:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.2.202
description:
2025-01-30 06:58:21 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.2.202]:39750: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 06:58:21 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (plamigraic) [91.56.31.167]:63602: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 06:58:44 ait sshd[731096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.95.97.29
description:
Jan 30 06:59:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.95.97.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.79.235
description:
2025-01-30 06:58:14 dovecot_login authenticator failed for ([127.0.0.1]) [218.1.79.235]:37404: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.2.202
description:
Jan 30 06:58:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.44.198
description:
[2025-01-30 06:58:38 +0100] info [webmaild] 45.4.44.198 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 06:58:44 ait sshd[731096]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 06:58:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.124.75.218
description:
[2025-01-30 06:58:24 +0100] info [webmaild] 196.124.75.218 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 30 06:58:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 06:58:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.124.32.187
description:
Jan 30 06:59:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.124.32.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.32.187
description:
2025-01-30 06:59:06 dovecot_plain authenticator failed for ([203.124.32.187]) [203.124.32.187]:38983: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.79.235
description:
Jan 30 06:58:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.79.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
description:
Jan 30 06:58:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
description:
2025-01-30 06:58:17 dovecot_plain authenticator failed for (ratal) [5.167.48.130]:35442: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.97.29
description:
2025-01-30 06:59:10 dovecot_login authenticator failed for ([127.0.0.1]) [93.95.97.29]:44034: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.227.189
description:
2025-01-30 06:59:19 dovecot_plain authenticator failed for ([112.164.227.189]) [112.164.227.189]:45038: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.164.227.189
description:
Jan 30 06:59:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.164.227.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.239.229
description:
[2025-01-30 06:59:30 +0100] info [webmaild] 187.19.239.229 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 30 07:00:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.18.222.39
description:
Jan 30 07:00:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.18.222.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.18.222.39
description:
2025-01-30 07:00:29 dovecot_login authenticator failed for ([127.0.0.1]) [129.18.222.39]:33438: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-30 07:00:56 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:24778: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-30 07:01:01 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:63276: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-01-30 07:00:33 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:55490: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.11
description:
2025-01-30 07:00:51 dovecot_plain authenticator failed for (m121-202-205-11.smartone.com) [121.202.205.11]:5709: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.1.79.235
description:
2025-01-30 07:00:37 dovecot_login authenticator failed for ([127.0.0.1]) [218.1.79.235]:34451: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.11
description:
Jan 30 07:00:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 30 07:01:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.220.16.46
description:
2025-01-30 07:00:35 dovecot_plain authenticator failed for ([119.220.16.46]) [119.220.16.46]:47805: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.1.79.235
description:
Jan 30 07:00:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.1.79.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Jan 30 07:00:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.220.16.46
description:
Jan 30 07:00:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.220.16.46 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 07:01:45 ait sshd[732462]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
description:
Jan 30 07:01:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
description:
2025-01-30 07:01:12 dovecot_login authenticator failed for ([127.0.0.1]) [222.163.236.235]:55292: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.130.107
description:
2025-01-30 07:01:19 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.130.107]:37951: 535 Incorrect authentication data (set_id=abio17)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-01.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.63.165.61
description:
2025-01-30 07:01:47 dovecot_plain authenticator failed for ([41.63.165.61]) [41.63.165.61]:2276: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
description:
Jan 30 07:01:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 07:01:45 ait sshd[732462]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-30 07:01:10 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:24295: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.130.107
description:
Jan 30 07:01:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.130.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.63.165.61
description:
Jan 30 07:01:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.63.165.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 07:01:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
description:
2025-01-30 07:01:28 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:38884: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.107.226.3
description:
[2025-01-30 07:01:39 +0100] info [webmaild] 189.107.226.3 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 30 07:02:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-30 07:02:25 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:51894: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.223.21.169
description:
[2025-01-30 07:02:26 +0100] info [webmaild] 177.223.21.169 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.225.167.149
description:
[2025-01-30 07:02:20 +0100] info [webmaild] 187.225.167.149 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 30 07:02:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-30 07:02:48 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:45870: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.127.240
description:
47.128.127.240 - - [30/Jan/2025:07:02:24 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14316643 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=106%2C125%2C30&filter_course-language=79%2C121%2C95%2C183%2C99%2C118&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.127.240


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.214.164.161
description:
[2025-01-30 07:03:13 +0100] info [webmaild] 177.214.164.161 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Jan 30 07:03:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.209
description:
Jan 30 07:03:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.209
description:
2025-01-30 07:03:43 dovecot_plain authenticator failed for ([102.69.163.209]) [102.69.163.209]:42748: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 07:03:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 95.215.206.182
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:07-03.95.215.206.182||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-01-30 07:03:36 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:49742: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.72.198.235
description:
[2025-01-30 07:05:24 +0100] info [webmaild] 131.72.198.235 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.3.136
description:
2025-01-30 07:05:16 dovecot_login authenticator failed for ([127.0.0.1]) [182.60.3.136]:41637: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.161.134
description:
Jan 30 07:05:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 07:06:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.60.3.136
description:
Jan 30 07:05:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.60.3.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.161.134
description:
2025-01-30 07:05:23 dovecot_login authenticator failed for ([127.0.0.1]) [90.189.161.134]:40750: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-30 07:06:45 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:43630: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.214.3
description:
[2025-01-30 07:06:12 +0100] info [webmaild] 168.232.214.3 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.146.126
description:
Jan 30 07:06:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.146.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-30 07:06:50 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:56808: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.112.10
description:
[2025-01-30 07:07:04 +0100] info [webmaild] 213.230.112.10 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.240.244.17
description:
[2025-01-30 07:06:12 +0100] info [webmaild] 201.240.244.17 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.146.126
description:
2025-01-30 07:06:28 dovecot_plain authenticator failed for ([27.45.146.126]) [27.45.146.126]:36487: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 30 07:06:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Jan 30 07:06:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-01-30 07:06:37 dovecot_plain authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:63236: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Jan 30 07:06:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 30 07:08:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.249.179
description:
2025-01-30 07:09:02 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.249.179]:33646: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.193.78
description:
2025-01-30 07:08:11 dovecot_plain authenticator failed for ([121.188.193.78]) [121.188.193.78]:50720: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.142.242
description:
Jan 30 07:08:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.142.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.142.242
description:
2025-01-30 07:08:24 dovecot_plain authenticator failed for 242.142.48.116.static.netvigator.com [116.48.142.242]:54790: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Jan 30 07:08:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-01-30 07:08:30 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:36060: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 135.148.105.7
description:
Jan 30 07:08:32 ait sshd[735473]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=135.148.105.7  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-30 07:08:52 dovecot_plain authenticator failed for (200-205-22-25.customer.tdatabrasil.net.br) [186.200.158.42]:34609: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.249.179
description:
Jan 30 07:09:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.249.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.71.6.31
description:
Jan 30 07:09:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.71.6.31 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.39.228.176
description:
[2025-01-30 07:09:15 +0100] info [webmaild] 46.39.228.176 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 07:09:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.6.31
description:
2025-01-30 07:09:13 dovecot_login authenticator failed for ([127.0.0.1]) [178.71.6.31]:43293: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 30 07:09:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-30 07:09:45 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-177.static.tpgi.com.au) [110.175.220.250]:35313: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.12.179
description:
Jan 30 07:09:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.12.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.178.97
description:
[2025-01-30 07:10:04 +0100] info [webmaild] 168.196.178.97 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
description:
2025-01-30 07:09:33 dovecot_plain authenticator failed for ([128.185.12.179]) [128.185.12.179]:46922: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.26.65.51
description:
Jan 30 07:10:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.26.65.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
description:
2025-01-30 07:10:12 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:48916: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.125.92
description:
[2025-01-30 07:10:27 +0100] info [webmaild] 186.235.125.92 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.113.32.149
description:
[2025-01-30 07:11:05 +0100] info [webmaild] 196.113.32.149 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 30 07:10:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-30 07:10:21 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:38736: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.242.102.131
domain: a-rapp.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-10.195.242.102.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.98.235
description:
[2025-01-30 07:11:07 +0100] info [webmaild] 170.239.98.235 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-30 07:11:28 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:59600: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-01-30 07:11:10 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:59070: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 07:11:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 30 07:11:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Jan 30 07:11:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.102.207.89
description:
[2025-01-30 07:12:59 +0100] info [webmaild] 177.102.207.89 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Jan 30 07:13:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 30 07:13:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-01-30 07:13:32 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:40974: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.125.94
description:
Jan 30 07:13:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
description:
Jan 30 07:13:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
description:
2025-01-30 07:13:40 dovecot_plain authenticator failed for ([1.247.245.61]) [1.247.245.61]:42769: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.180.171.33
description:
[2025-01-30 07:13:45 +0100] info [webmaild] 187.180.171.33 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.125.94
description:
2025-01-30 07:13:12 dovecot_plain authenticator failed for (94.125.156.175.unknown.m1.com.sg) [175.156.125.94]:36342: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-30 07:13:16 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:48888: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 07:14:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.191.253.130
description:
2025-01-30 07:14:31 dovecot_plain authenticator failed for syn-068-191-253-130.biz.spectrum.com ([68.191.253.131]) [68.191.253.130]:52980: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.237.90
description:
2025-01-30 07:14:35 dovecot_plain authenticator failed for (187-50-193-126.customer.tdatabrasil.net.br) [201.28.237.90]:47838: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 07:14:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.244.231.239
description:
Jan 30 07:15:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.244.231.239 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.3.81
description:
[2025-01-30 07:14:18 +0100] info [webmaild] 45.167.3.81 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.191.253.130
description:
Jan 30 07:14:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.191.253.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
description:
Jan 30 07:14:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
description:
2025-01-30 07:14:41 dovecot_plain authenticator failed for (5x166x68x184.dynamic.barnaul.ertelecom.ru) [5.166.68.184]:59578: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 07:15:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.155.146
description:
Jan 30 07:15:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.238.90
description:
2025-01-30 07:15:45 dovecot_plain authenticator failed for ([122.187.147.17]) [128.185.238.90]:45126: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-30 07:16:07 dovecot_plain authenticator failed for (noeman) [65.20.183.209]:45788: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-01-30 07:15:12 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:35328: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.61.95
description:
2025-01-30 07:15:18 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:41764: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.155.146
description:
2025-01-30 07:15:25 dovecot_plain authenticator failed for ([14.49.155.146]) [14.49.155.146]:48433: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.238.90
description:
Jan 30 07:15:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.238.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.166.140.172
description:
2025-01-30 07:15:55 dovecot_plain authenticator failed for h198-166-140-172.ptr.cidc.telus.com [198.166.140.172]:16253: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.4.150
description:
2025-01-30 07:15:29 dovecot_plain authenticator failed for ([222.180.4.150]) [222.180.4.150]:49447: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.244.231.239
description:
2025-01-30 07:15:09 dovecot_login authenticator failed for ([127.0.0.1]) [120.244.231.239]:59471: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.131.106.195
description:
[2025-01-30 07:15:11 +0100] info [webmaild] 37.131.106.195 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.52.73.86
description:
2025-01-30 07:15:15 dovecot_login authenticator failed for ([127.0.0.1]) [95.52.73.86]:60790: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.4.150
description:
Jan 30 07:15:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.4.150 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-15.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 30 07:16:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Jan 30 07:15:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.52.73.86
description:
Jan 30 07:15:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.52.73.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.61.95
description:
Jan 30 07:15:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.61.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.166.140.172
description:
Jan 30 07:15:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.166.140.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.124.218.207
description:
Jan 30 07:16:31 ait sshd[738687]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.124.218.207  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.107.198
description:
2025-01-30 07:16:40 dovecot_plain authenticator failed for ([187.92.178.105]) [187.8.107.198]:54592: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.227.66.92
description:
Jan 30 07:16:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.227.66.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
description:
2025-01-30 07:17:04 dovecot_login authenticator failed for ([207.102.66.226]) [207.102.66.226]:64137: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-01-30 07:16:50 dovecot_login authenticator failed for ([188.227.66.92]) [188.227.66.92]:60758: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.243
description:
2025-01-30 07:16:29 dovecot_plain authenticator failed for ([118.91.176.243]) [118.91.176.243]:48057: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.107.198
description:
Jan 30 07:16:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.107.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
description:
Jan 30 07:17:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.248.41
description:
[2025-01-30 07:16:44 +0100] info [webmaild] 177.185.248.41 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 176.124.218.207
description:
Jan 30 07:18:54 ait sshd[739645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=176.124.218.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.150.88.37
description:
Jan 30 07:18:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.150.88.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 07:18:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.168.65.150
description:
Jan 30 07:18:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.168.65.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.168.65.150
description:
2025-01-30 07:18:47 dovecot_login authenticator failed for ([127.0.0.1]) [217.168.65.150]:60824: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.143.165
description:
Jan 30 07:18:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.143.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
description:
2025-01-30 07:18:16 dovecot_plain authenticator failed for ([92.124.143.165]) [92.124.143.165]:33868: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.150.88.37
description:
2025-01-30 07:18:40 dovecot_login authenticator failed for ([127.0.0.1]) [121.150.88.37]:54318: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.195.141
description:
[2025-01-30 07:18:53 +0100] info [webmaild] 45.65.195.141 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.63.18
description:
2025-01-30 07:19:22 dovecot_plain authenticator failed for ([114.98.63.18]) [114.98.63.18]:45545: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
description:
Jan 30 07:19:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-30 07:19:44 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (maeolizar) [109.67.154.24]:56608: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.98.63.18
description:
Jan 30 07:19:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.98.63.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
description:
2025-01-30 07:19:30 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:50698: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 30 07:19:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.168.65.150
description:
2025-01-30 07:20:44 dovecot_login authenticator failed for ([127.0.0.1]) [217.168.65.150]:37123: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.249.99.167
description:
2025-01-30 07:20:39 dovecot_login authenticator failed for ([127.0.0.1]) [46.249.99.167]:37812: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.168.65.150
description:
Jan 30 07:20:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.168.65.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.249.99.167
description:
Jan 30 07:20:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.249.99.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.43.101.35
description:
[2025-01-30 07:20:39 +0100] info [webmaild] 38.43.101.35 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 139.135.53.52
description:
[2025-01-30 07:21:56 +0100] info [webmaild] 139.135.53.52 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.95.161.100
description:
[2025-01-30 07:21:19 +0100] info [webmaild] 187.95.161.100 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.130.107
description:
2025-01-30 07:21:51 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.130.107]:54541: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.130.107
description:
Jan 30 07:21:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.130.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.93.198
description:
Jan 30 07:23:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.93.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.221.224.122
description:
Jan 30 07:22:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.221.224.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.142.220.155
description:
Jan 30 07:22:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.142.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.47.171
description:
[2025-01-30 07:22:49 +0100] info [webmaild] 103.151.47.171 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.2.202
description:
2025-01-30 07:22:57 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.2.202]:37952: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 07:22:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.2.202
description:
Jan 30 07:22:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.221.224.122
description:
2025-01-30 07:22:17 dovecot_login authenticator failed for ([127.0.0.1]) [117.221.224.122]:54300: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.142.220.155
description:
2025-01-30 07:22:27 dovecot_login authenticator failed for ([127.0.0.1]) [5.142.220.155]:48025: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 07:23:08 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:40413: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.87.137.185
description:
[2025-01-30 07:24:25 +0100] info [webmaild] 179.87.137.185 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.99.54
description:
Jan 30 07:24:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.199.99.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.8
description:
Jan 30 07:24:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-30 07:24:51 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:52439: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 30 07:24:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 30 07:25:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 30 07:24:14 ait sshd[741481]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.8
description:
2025-01-30 07:24:39 dovecot_plain authenticator failed for 111-70-19-8.emome-ip.hinet.net [111.70.19.8]:44961: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.216.85.119
description:
Jan 30 07:24:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.216.85.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 07:24:14 ait sshd[741481]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.227.200.201
description:
Jan 30 07:24:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.227.200.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.227.200.201
description:
2025-01-30 07:24:31 dovecot_login authenticator failed for ([127.0.0.1]) [171.227.200.201]:32487: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.216.85.119
description:
2025-01-30 07:24:43 dovecot_login authenticator failed for ([127.0.0.1]) [211.216.85.119]:60900: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
description:
Jan 30 07:25:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
description:
2025-01-30 07:25:42 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:35266: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.13.113.226
description:
[2025-01-30 07:25:57 +0100] info [webmaild] 186.13.113.226 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.234.179
description:
[2025-01-30 07:25:13 +0100] info [webmaild] 177.126.234.179 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.136.176.12
description:
2025-01-30 07:25:20 dovecot_plain authenticator failed for ([83.136.176.12]) [83.136.176.12]:51894: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.37.17.124
description:
Jan 30 07:25:39 ait sshd[742284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.37.17.124  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.195
description:
Jan 30 07:25:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-30 07:25:10 dovecot_plain authenticator failed for ([101.91.236.162]) [218.78.92.131]:53674: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.136.176.12
description:
Jan 30 07:25:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.136.176.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.16.195
description:
2025-01-30 07:25:55 dovecot_plain authenticator failed for ([27.71.16.195]) [27.71.16.195]:40102: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-01-30 07:26:28 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:38046: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.127.68.45
description:
[2025-01-30 07:26:33 +0100] info [webmaild] 179.127.68.45 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.2.123.19
description:
2025-01-30 07:26:15 dovecot_plain authenticator failed for (dynamic-ip-adsl.viettel.vn) [117.2.123.19]:53430: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Jan 30 07:26:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.2.123.19
description:
Jan 30 07:26:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.2.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 07:27:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.191.83.250
description:
2025-01-30 07:27:25 dovecot_plain authenticator failed for ([117.191.83.250]) [117.191.83.250]:48258: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.191.83.250
description:
Jan 30 07:27:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.191.83.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-01-30 07:27:34 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:22996: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Jan 30 07:27:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77142160
name: IM360 WAF: Infectors. Dirb like fuzzing
abuser: 109.199.108.140
domain: 136.243.145.84:443
description:
IM360 WAF: Infectors. Dirb like fuzzing||MVN:REQUEST_FILENAME||MV:/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 122.224.68.164
description:
2025-01-30 07:28:29 H=(mail.bsoft.cloud) [122.224.68.164]:47613 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<ronswqww@bsoft.cloud> rejected RCPT <E1puNZH-0001Rw-1e@ait.aitvarsity.net>: Unrouteable address


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.37.17.124
description:
Jan 30 07:28:13 ait sshd[743029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.37.17.124  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 07:28:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.74.200.224
description:
[2025-01-30 07:28:20 +0100] info [webmaild] 177.74.200.224 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-28.15.206.171.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.31.179.109
description:
[2025-01-30 07:28:58 +0100] info [webmaild] 103.31.179.109 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.192.29.74
description:
2025-01-30 07:29:34 dovecot_plain authenticator failed for ([120.192.29.74]) [120.192.29.74]:56933: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 30 07:29:44 ait sshd[743776]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 30 07:29:44 ait sshd[743776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 30 07:29:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-30 07:29:23 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:49382: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.192.29.74
description:
Jan 30 07:29:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.192.29.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.118.39
description:
[2025-01-30 07:29:32 +0100] info [webmaild] 45.190.118.39 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.91.74.187
description:
2025-01-30 07:30:44 dovecot_plain authenticator failed for ([103.91.74.187]) [103.91.74.187]:54686: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Jan 30 07:30:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.168.173.87
description:
2025-01-30 07:31:01 dovecot_plain authenticator failed for (chipcare) [185.168.173.87]:47422: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 07:31:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 07:31:08 dovecot_plain authenticator failed for (lucheric) [207.188.157.230]:55447: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.190.243
description:
2025-01-30 07:30:23 dovecot_plain authenticator failed for ([221.162.190.243]) [221.162.190.243]:56357: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.91.74.187
description:
Jan 30 07:30:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.91.74.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.190.243
description:
Jan 30 07:30:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.190.243 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.85.154.210
description:
[2025-01-30 07:30:24 +0100] info [webmaild] 189.85.154.210 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-31.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.241.167
description:
[2025-01-30 07:31:51 +0100] info [webmaild] 138.219.241.167 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.16.185
description:
47.128.16.185 - - [30/Jan/2025:07:33:00 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20059495 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=125%2C30%2C61&filter_course-language=79%2C95" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.16.185


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads22a00059y||WPU:ads22a00059y||RSV:6.65||T:APACHE||MV:07-32.170.205.31.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 07:32:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 07:32:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.87.128.144
description:
[2025-01-30 07:32:38 +0100] info [webmaild] 78.87.128.144 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Jan 30 07:33:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.152.81.141
description:
[2025-01-30 07:33:21 +0100] info [webmaild] 24.152.81.141 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-01-30 07:33:20 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:44139: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Jan 30 07:33:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-01-30 07:33:35 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:45472: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.88.129
description:
Jan 30 07:34:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.88.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.143
description:
Jan 30 07:34:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Jan 30 07:34:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.72.186
description:
[2025-01-30 07:34:12 +0100] info [webmaild] 213.230.72.186 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
description:
2025-01-30 07:34:34 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:43742: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.88.129
description:
2025-01-30 07:34:49 dovecot_plain authenticator failed for ([2.55.88.129]) [2.55.88.129]:37307: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-01-30 07:34:49 dovecot_login authenticator failed for ([171.244.60.184]) [171.244.60.184]:54818: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.143
description:
2025-01-30 07:34:41 dovecot_plain authenticator failed for ([122.187.227.143]) [122.187.227.143]:56955: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.128.211
description:
2025-01-30 07:34:29 dovecot_plain authenticator failed for ([112.27.128.211]) [112.27.128.211]:53032: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
description:
Jan 30 07:34:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Jan 30 07:34:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-01-30 07:35:00 dovecot_login authenticator failed for ([58.224.55.22]) [58.224.55.22]:49708: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
description:
Jan 30 07:34:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.254.225.100
description:
2025-01-30 07:36:05 dovecot_plain authenticator failed for 100.225.254.193.infosys.su [193.254.225.100]:57482: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.124.143.165
description:
2025-01-30 07:35:57 dovecot_plain authenticator failed for ([92.124.143.165]) [92.124.143.165]:37377: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.99.168
description:
Jan 30 07:35:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.99.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.99.168
description:
2025-01-30 07:35:50 dovecot_login authenticator failed for ([127.0.0.1]) [49.245.99.168]:34259: 535 Incorrect authentication data (set_id=ads21a00069y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 30 07:35:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.153.114.124
description:
Jan 30 07:35:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.153.114.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.124.143.165
description:
Jan 30 07:35:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.124.143.165 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.107.21.96
description:
[2025-01-30 07:35:55 +0100] info [webmaild] 200.107.21.96 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.239
description:
47.128.22.239 - - [30/Jan/2025:07:35:36 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9392441 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61&filter_course-language=121%2C198%2C120&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.239


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.254.225.100
description:
Jan 30 07:36:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.254.225.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.153.114.124
description:
2025-01-30 07:35:37 dovecot_login authenticator failed for ([127.0.0.1]) [218.153.114.124]:4607: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 30 07:36:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 30 07:36:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.221.115.14
description:
[2025-01-30 07:37:02 +0100] info [webmaild] 201.221.115.14 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 07:36:54 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (bered) [91.56.31.167]:64965: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 30 07:36:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.112.159
description:
Jan 30 07:37:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.112.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 30 07:36:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-30 07:36:15 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:40988: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
description:
2025-01-30 07:36:25 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:35217: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
description:
Jan 30 07:36:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.84.61.140
description:
[2025-01-30 07:36:43 +0100] info [webmaild] 181.84.61.140 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.112.159
description:
2025-01-30 07:37:10 dovecot_plain authenticator failed for 46-162-112-159.cust.bredband2.com [46.162.112.159]:43028: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 30 07:37:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 30 07:38:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Jan 30 07:37:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-30 07:38:10 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:34571: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.225.61.91
description:
[2025-01-30 07:37:54 +0100] info [webmaild] 45.225.61.91 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-01-30 07:37:56 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:59270: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-01-30 07:38:05 dovecot_login authenticator failed for ([127.0.0.1]) [102.215.188.37]:60668: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 30 07:38:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Jan 30 07:38:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 07:37:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-30 07:37:22 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:52560: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
description:
Jan 30 07:38:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-30 07:38:09 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (hagion) [195.159.217.71]:55070: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.154.56.124
description:
Jan 30 07:38:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.154.56.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.176.67
description:
2025-01-30 07:38:47 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.176.67]:50622: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.176.67
description:
Jan 30 07:38:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.150.88.88
description:
Jan 30 07:38:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.150.88.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.150.88.88
description:
2025-01-30 07:38:32 dovecot_login authenticator failed for ([127.0.0.1]) [121.150.88.88]:54668: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.131.89
description:
Jan 30 07:38:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.131.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.131.89
description:
2025-01-30 07:38:39 dovecot_plain authenticator failed for ([59.24.131.89]) [59.24.131.89]:38414: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.56.124
description:
2025-01-30 07:38:48 dovecot_plain authenticator failed for ([160.154.56.124]) [160.154.56.124]:20891: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-01-30 07:38:12 dovecot_login authenticator failed for ([127.0.0.1]) [161.35.200.202]:35068: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.123.74
description:
2025-01-30 07:39:21 dovecot_login authenticator failed for ([127.0.0.1]) [202.4.123.74]:39474: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.246.210.13
domain: ait.edu.gh
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/https:/golem.com||User:ait02||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 07:39:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.93.198
description:
Jan 30 07:39:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.93.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.44.90.85
description:
[2025-01-30 07:40:06 +0100] info [webmaild] 194.44.90.85 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 07:39:12 dovecot_plain authenticator failed for (prefic) [81.211.77.58]:9598: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.123.74
description:
Jan 30 07:39:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.123.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 07:39:27 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:49412: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.128.100.202
description:
[2025-01-30 07:40:56 +0100] info [webmaild] 188.128.100.202 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 07:40:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.25.152.83
description:
[2025-01-30 07:40:39 +0100] info [webmaild] 200.25.152.83 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.227.184.21
description:
[2025-01-30 07:41:48 +0100] info [webmaild] 45.227.184.21 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-42.15.206.171.64


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 109.234.161.228
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:07-41.109.234.161.228


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.193.39.96
description:
Jan 30 07:42:15 ait sshd[748611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.193.39.96  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 30 07:42:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.174.182.38
description:
Jan 30 07:43:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.174.182.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.174.182.38
description:
2025-01-30 07:43:07 dovecot_plain authenticator failed for 203-174-182-38.ade.static-ipl.aapt.com.au [203.174.182.38]:57586: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-30 07:42:56 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br (186-247-196-225.user.veloxzone.com.br) [186.247.196.106]:55821: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.81.249
description:
[2025-01-30 07:44:03 +0100] info [webmaild] 179.189.81.249 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 07:43:19 ait sshd[748969]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 07:43:19 ait sshd[748969]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 30 07:43:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-30 07:43:28 dovecot_plain authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:60134: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
description:
Jan 30 07:43:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-01-30 07:43:47 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:51754: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.159.150.111
description:
2025-01-30 07:44:23 dovecot_plain authenticator failed for ([177.159.150.111]) [177.159.150.111]:50489: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.9.146
description:
Jan 30 07:44:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.9.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 30 07:44:42 ait sshd[749595]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.14.24.46
description:
[2025-01-30 07:44:47 +0100] info [webmaild] 187.14.24.46 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.140.210.134
description:
Jan 30 07:44:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.140.210.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.108.165
description:
2025-01-30 07:44:43 dovecot_plain authenticator failed for ([116.116.108.165]) [116.116.108.165]:55845: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.199.209.60
description:
Jan 30 07:44:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.199.209.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
description:
2025-01-30 07:44:53 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:41856: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.159.150.111
description:
Jan 30 07:44:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.159.150.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.140.210.134
description:
2025-01-30 07:44:40 dovecot_plain authenticator failed for (gelly) [94.140.210.134]:49594: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.108.165
description:
Jan 30 07:44:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.108.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 07:44:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.251.229.184
description:
[2025-01-30 07:44:49 +0100] info [webmaild] 179.251.229.184 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 07:44:43 dovecot_plain authenticator failed for (phora) [207.188.157.230]:43133: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.9.146
description:
2025-01-30 07:44:28 dovecot_plain authenticator failed for ([180.166.163.26]) [58.246.9.146]:53298: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 07:44:42 ait sshd[749595]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
description:
Jan 30 07:45:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.115.211
description:
2025-01-30 07:45:34 dovecot_plain authenticator failed for (211.115.156.175.unknown.m1.com.sg) [175.156.115.211]:52651: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.50.217.76
description:
[2025-01-30 07:45:39 +0100] info [webmaild] 186.50.217.76 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-01-30 07:46:02 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:51685: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.115.211
description:
Jan 30 07:45:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.115.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
description:
2025-01-30 07:45:24 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:55433: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.60.173.250
description:
Jan 30 07:45:33 ait sshd[749895]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.60.173.250  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
description:
Jan 30 07:46:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.212.153.73
description:
Jan 30 07:46:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.212.153.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.250.226
description:
2025-01-30 07:46:44 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.250.226]:54853: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.250.209.87
description:
Jan 30 07:46:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.250.209.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.250.209.87
description:
2025-01-30 07:46:50 dovecot_login authenticator failed for i6dfad157.versanet.de ([127.0.0.1]) [109.250.209.87]:53514: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 07:46:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.250.226
description:
Jan 30 07:46:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.250.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.153.73
description:
2025-01-30 07:46:13 dovecot_plain authenticator failed for (73.153.212.218.starhub.net.sg) [218.212.153.73]:48844: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 07:47:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.60.173.250
description:
Jan 30 07:47:57 ait sshd[750750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.60.173.250  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.106.163.250
description:
[2025-01-30 07:48:04 +0100] info [webmaild] 193.106.163.250 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
description:
Jan 30 07:48:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 07:48:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
description:
2025-01-30 07:48:23 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:56022: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.13.24
description:
Jan 30 07:48:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.13.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.13.24
description:
2025-01-30 07:48:34 dovecot_plain authenticator failed for 111-70-13-24.emome-ip.hinet.net [111.70.13.24]:33980: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.218.162.146
description:
[2025-01-30 07:48:36 +0100] info [webmaild] 201.218.162.146 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.251.182
description:
[2025-01-30 07:48:58 +0100] info [webmaild] 45.5.251.182 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.46
description:
Jan 30 07:49:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.93.198
description:
Jan 30 07:49:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.93.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.169.41.188
description:
2025-01-30 07:50:07 dovecot_login authenticator failed for ([127.0.0.1]) [113.169.41.188]:58258: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 30 07:49:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-49.147.135.223.135


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.14.30.146
description:
[2025-01-30 07:49:27 +0100] info [webmaild] 45.14.30.146 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 07:49:51 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:43501: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.169.41.188
description:
Jan 30 07:50:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.169.41.188 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 30 07:50:47 ait sshd[752151]: Invalid user meelevenverliesbegeleiding.nl 2a02 from 111.231.56.128 port 50440


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 07:50:47 ait sshd[752151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 188.245.228.175
domain: lms.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-50.188.245.228.175


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 07:50:47 ait sshd[752151]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.50.83
description:
2025-01-30 07:51:08 dovecot_plain authenticator failed for ([59.8.50.83]) [59.8.50.83]:51880: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-50.103.249.112.157


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.227.209.106
domain: lms.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-50.165.227.209.106


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 211.149.239.234
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-50.211.149.239.234


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 07:51:15 ait sshd[752204]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 07:51:15 ait sshd[752204]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
description:
2025-01-30 07:51:16 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:34569: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.111.113
description:
Jan 30 07:52:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.111.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.142.101.86
description:
[2025-01-30 07:52:03 +0100] info [webmaild] 102.142.101.86 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.111.113
description:
2025-01-30 07:52:02 dovecot_plain authenticator failed for ([221.0.111.113]) [221.0.111.113]:43724: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
description:
Jan 30 07:51:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 07:51:14 ait sshd[752204]: Invalid user art-of-contour.de 2a12 from 122.51.104.242 port 55714


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.209.198.36
description:
[2025-01-30 07:52:50 +0100] info [webmaild] 103.209.198.36 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
description:
Jan 30 07:52:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.144.140
description:
Jan 30 07:52:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.144.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 30 07:52:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-30 07:52:42 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:48800: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 30 07:52:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-01-30 07:53:06 dovecot_login authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:47251: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.19.117
description:
Jan 30 07:52:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.19.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.19.117
description:
2025-01-30 07:52:37 dovecot_plain authenticator failed for ([222.116.19.117]) [222.116.19.117]:33637: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.144.140
description:
2025-01-30 07:52:26 dovecot_plain authenticator failed for ([112.15.144.140]) [112.15.144.140]:45578: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.95.74
description:
[2025-01-30 07:52:48 +0100] info [webmaild] 177.55.95.74 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-30 07:52:53 dovecot_plain authenticator failed for (18712549.telemar.net.br) [187.76.174.254]:59516: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.148.41
description:
2025-01-30 07:52:53 dovecot_plain authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:51469: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
description:
2025-01-30 07:52:54 dovecot_login authenticator failed for ([119.84.241.94]) [119.84.241.94]:40892: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Jan 30 07:53:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.148.41
description:
Jan 30 07:52:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.148.41 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.75.199
description:
[2025-01-30 07:53:39 +0100] info [webmaild] 38.156.75.199 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 07:54:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.145.123
description:
2025-01-30 07:54:48 dovecot_login authenticator failed for ([61.191.145.123]) [61.191.145.123]:36137: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS22A00059Y||WPU:ADS22A00059Y||RSV:6.65||T:APACHE||MV:07-54.170.205.31.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.131
description:
Jan 30 07:55:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.131
description:
2025-01-30 07:55:09 dovecot_login authenticator failed for ([27.40.100.131]) [27.40.100.131]:44140: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 07:54:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.145.123
description:
Jan 30 07:54:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.145.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 30 07:55:39 ait sshd[753906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.200.14.2
description:
Jan 30 07:55:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.200.14.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 07:55:39 ait sshd[753906]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.200.14.2
description:
2025-01-30 07:55:22 dovecot_login authenticator failed for ([202.200.14.2]) [202.200.14.2]:48196: 535 Incorrect authentication data (set_id=ampofo)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-55.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.138.15.194
description:
Jan 30 07:56:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.138.15.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.138.15.194
description:
2025-01-30 07:56:48 dovecot_login authenticator failed for ([127.0.0.1]) [164.138.15.194]:39546: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.160.43
description:
2025-01-30 07:56:57 dovecot_login authenticator failed for ([127.0.0.1]) [117.253.160.43]:51075: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.6.196.35
description:
[2025-01-30 07:56:20 +0100] info [webmaild] 213.6.196.35 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 07:56:27 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (amisene) [91.56.31.167]:64397: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-30 07:56:30 dovecot_plain authenticator failed for (boatenyst) [93.159.152.6]:58156: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.160.43
description:
Jan 30 07:56:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.160.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.190
description:
Jan 30 07:56:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.190 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.187
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ADS22A00059Y||WPU:ADS22A00059Y||RSV:6.65||T:APACHE||MV:07-56.170.205.31.187


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.1.179.5
description:
[2025-01-30 07:57:09 +0100] info [webmaild] 187.1.179.5 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 30 07:56:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 30 07:56:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.84.124.26
description:
[2025-01-30 07:56:43 +0100] info [webmaild] 177.84.124.26 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.190
description:
2025-01-30 07:56:24 dovecot_plain authenticator failed for (siterners) [2.110.10.190]:60846: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 07:57:15 ait sshd[754619]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 07:57:15 ait sshd[754619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 07:57:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.209.106.30
description:
[2025-01-30 07:57:35 +0100] info [webmaild] 181.209.106.30 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 07:59:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 30 07:59:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-30 07:59:26 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:53758: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.217.129.251
description:
[2025-01-30 08:00:38 +0100] info [webmaild] 201.217.129.251 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.71.200.180
description:
[2025-01-30 08:00:12 +0100] info [webmaild] 189.71.200.180 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 08:01:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.80.187.143
description:
[2025-01-30 08:01:15 +0100] info [webmaild] 191.80.187.143 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.70.238
description:
[2025-01-30 08:01:34 +0100] info [webmaild] 37.77.70.238 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-30 08:02:15 dovecot_plain authenticator failed for (surrity) [109.166.70.166]:46619: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.112.190
description:
Jan 30 08:02:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.112.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.112.190
description:
2025-01-30 08:02:35 dovecot_plain authenticator failed for ([60.219.112.190]) [60.219.112.190]:47825: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Jan 30 08:02:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-01-30 08:02:55 dovecot_plain authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:60912: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 08:02:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 08:03:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 30 08:02:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 08:03:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.5.26
description:
2025-01-30 08:03:50 dovecot_plain authenticator failed for ([183.237.5.26]) [183.237.5.26]:51079: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 30 08:03:45 ait sshd[757444]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 08:03:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.173.82.198
description:
2025-01-30 08:04:07 dovecot_plain authenticator failed for ([222.173.82.198]) [222.173.82.198]:8790: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 08:03:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 08:03:45 ait sshd[757444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.46.202.61
description:
Jan 30 08:04:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.46.202.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.46.202.61
description:
2025-01-30 08:04:02 dovecot_plain authenticator failed for ([211.46.202.61]) [211.46.202.61]:35957: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.173.82.198
description:
Jan 30 08:04:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.173.82.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.5.26
description:
Jan 30 08:03:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.5.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 30 08:03:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-30 08:03:53 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:56546: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.198.151.67
description:
[2025-01-30 08:04:25 +0100] info [webmaild] 41.198.151.67 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 08:05:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.36.83
description:
[2025-01-30 08:04:37 +0100] info [webmaild] 45.176.36.83 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Jan 30 08:05:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.217.70.151
description:
Jan 30 08:05:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.217.70.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Jan 30 08:05:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.217.70.151
description:
2025-01-30 08:05:33 dovecot_plain authenticator failed for ([171.217.70.151]) [171.217.70.151]:58950: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-01-30 08:05:43 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:51074: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.106.133.44
description:
[2025-01-30 08:05:11 +0100] info [webmaild] 85.106.133.44 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 08:05:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-01-30 08:05:21 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:56239: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.174.151.3
description:
[2025-01-30 08:05:31 +0100] info [webmaild] 186.174.151.3 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.148.130.25
description:
Jan 30 08:06:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.148.130.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.148.130.25
description:
2025-01-30 08:06:14 dovecot_plain authenticator failed for ([197.148.130.25]) [197.148.130.25]:46009: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 30 08:06:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 08:06:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.136.42.70
description:
2025-01-30 08:06:47 dovecot_plain authenticator failed for h-213-136-42-70.na.cust.bahnhof.se [213.136.42.70]:58069: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-30 08:06:36 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:35064: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.136.42.70
description:
Jan 30 08:06:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.136.42.70 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 222.239.193.242
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-06.222.239.193.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.0.69.202
description:
Jan 30 08:07:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.0.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
description:
2025-01-30 08:07:21 dovecot_plain authenticator failed for ([36.110.161.134]) [36.110.161.134]:55058: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.0.69.202
description:
2025-01-30 08:07:10 dovecot_plain authenticator failed for 191-0-69-202.host.telemar.net.br [191.0.69.202]:50839: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 222.239.193.242
domain: hostels.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-07.222.239.193.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
description:
Jan 30 08:07:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.249.198
description:
[2025-01-30 08:07:59 +0100] info [webmaild] 45.186.249.198 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-08.15.206.171.64


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-08.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 30 08:08:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.195.94.117
description:
[2025-01-30 08:08:47 +0100] info [webmaild] 186.195.94.117 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-30 08:08:47 dovecot_plain authenticator failed for (asses) [5.159.173.105]:53870: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.44.52
description:
[2025-01-30 08:08:16 +0100] info [webmaild] 158.181.44.52 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.31.83
description:
2025-01-30 08:09:22 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.31.83]:50380: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.168.65.150
description:
Jan 30 08:09:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.168.65.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.31.83
description:
Jan 30 08:09:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.31.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
description:
2025-01-30 08:09:47 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:58009: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.225.107
description:
[2025-01-30 08:09:10 +0100] info [webmaild] 177.55.225.107 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 30 08:09:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-30 08:09:31 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:46948: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.168.65.150
description:
2025-01-30 08:09:28 dovecot_login authenticator failed for ([127.0.0.1]) [217.168.65.150]:39153: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.169.113
description:
Jan 30 08:09:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.169.113 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 08:10:18 ait sshd[760213]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 08:10:18 ait sshd[760213]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 30 08:10:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.54.48
description:
Jan 30 08:10:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.54.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-30 08:10:38 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:38026: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.54.48
description:
2025-01-30 08:10:21 dovecot_plain authenticator failed for ([103.145.54.48]) [103.145.54.48]:60731: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.98.175.184
description:
Jan 30 08:11:51 ait sshd[760639]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.98.175.184 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.98.175.184
description:
Jan 30 08:11:51 ait sshd[760639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.98.175.184  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.234.202.84
description:
[2025-01-30 08:11:49 +0100] info [webmaild] 103.234.202.84 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.99.34.216
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:08-11.139.99.34.216||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
description:
2025-01-30 08:12:41 dovecot_plain authenticator failed for ([123.212.20.130]) [123.212.20.130]:37146: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 08:12:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.174.198
description:
[2025-01-30 08:12:34 +0100] info [webmaild] 181.191.174.198 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.180.201
description:
[2025-01-30 08:12:36 +0100] info [webmaild] 138.97.180.201 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.248.0.242
description:
Jan 30 08:12:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.248.0.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.0.242
description:
2025-01-30 08:12:22 dovecot_plain authenticator failed for ([103.15.60.138]) [218.248.0.242]:57664: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.130
description:
Jan 30 08:12:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 30 08:13:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-30 08:14:01 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:57394: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-01-30 08:14:01 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:54712: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.105.221.82
description:
Jan 30 08:13:17 ait sshd[760928]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.221.82


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.105.221.82
description:
Jan 30 08:13:19 ait sshd[760928]: Failed password for invalid user admin from 116.105.221.82 port 48316 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.82.157.126
description:
Jan 30 08:13:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.82.157.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 30 08:13:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 216.246.113.181
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-13.216.246.113.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.157.126
description:
2025-01-30 08:13:42 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:33468: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.105.221.82
description:
Jan 30 08:13:17 ait sshd[760928]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.105.221.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.204.24.38
description:
[2025-01-30 08:13:26 +0100] info [webmaild] 138.204.24.38 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-30 08:13:27 dovecot_plain authenticator failed for (sentanal) [185.113.51.55]:51270: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Jan 30 08:13:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.98.175.184
description:
Jan 30 08:14:18 ait sshd[761290]: Failed password for invalid user installer from 116.98.175.184 port 52510 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.99.233.151
description:
Jan 30 08:14:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.99.233.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.99.233.151
description:
2025-01-30 08:14:32 dovecot_plain authenticator failed for ([202.99.233.151]) [202.99.233.151]:45822: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.98.175.184
description:
Jan 30 08:14:16 ait sshd[761290]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.98.175.184 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.98.175.184
description:
Jan 30 08:14:16 ait sshd[761290]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.98.175.184


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.214.43.49
description:
[2025-01-30 08:15:34 +0100] info [webmaild] 179.214.43.49 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.98.175.184
description:
Jan 30 08:16:09 ait sshd[762284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.98.175.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 30 08:16:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.201.37.210
description:
Jan 30 08:16:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.201.37.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.201.37.210
description:
2025-01-30 08:16:27 dovecot_plain authenticator failed for ([50.201.37.210]) [50.201.37.210]:50078: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.98.175.184
description:
Jan 30 08:16:09 ait sshd[762284]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.98.175.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.237.119
description:
2025-01-30 08:16:27 dovecot_plain authenticator failed for ([220.80.237.119]) [220.80.237.119]:36242: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.105.221.82
description:
Jan 30 08:16:34 ait sshd[762478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.221.82


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.158.136.56
description:
[2025-01-30 08:16:21 +0100] info [webmaild] 186.158.136.56 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
description:
Jan 30 08:16:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.181.100.244
description:
[2025-01-30 08:16:15 +0100] info [webmaild] 187.181.100.244 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-30 08:16:17 dovecot_plain authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:33777: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.105.221.82
description:
Jan 30 08:16:34 ait sshd[762478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.105.221.82 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.181.212
description:
[2025-01-30 08:17:06 +0100] info [webmaild] 177.37.181.212 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.237.119
description:
Jan 30 08:16:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.237.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
description:
2025-01-30 08:16:14 dovecot_plain authenticator failed for ([180.149.214.193]) [110.38.70.172]:34756: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.32.96
description:
47.128.32.96 - - [30/Jan/2025:08:19:00 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14858190 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=263&id=204&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.32.96


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
description:
Jan 30 08:18:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
description:
2025-01-30 08:18:11 dovecot_login authenticator failed for syn-047-037-177-099.res.spectrum.com ([127.0.0.1]) [47.37.177.99]:39384: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.35.200.202
description:
Jan 30 08:19:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 161.35.200.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.215.93.42
description:
[2025-01-30 08:19:44 +0100] info [webmaild] 156.215.93.42 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.225.53.149
description:
2025-01-30 08:19:50 dovecot_plain authenticator failed for ([173.225.53.149]) [173.225.53.149]:37812: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 30 08:20:01 ait sshd[763909]: Invalid user art-of-contour.de 2a12 from 122.51.104.242 port 39772


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 08:20:02 ait sshd[763909]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 08:20:02 ait sshd[763909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.90.253
description:
2025-01-30 08:19:15 dovecot_plain authenticator failed for ([45.181.90.253]) [45.181.90.253]:53144: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.121
description:
Jan 30 08:19:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.90.253
description:
Jan 30 08:19:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.90.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.109.130.238
description:
2025-01-30 08:19:13 dovecot_login authenticator failed for ([127.0.0.1]) [70.109.130.238]:34240: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.109.130.238
description:
Jan 30 08:19:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.109.130.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.35.200.202
description:
2025-01-30 08:19:20 dovecot_login authenticator failed for ([127.0.0.1]) [161.35.200.202]:37586: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-30 08:19:29 dovecot_plain authenticator failed for ([121.178.185.141]) [121.178.185.141]:41856: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.121
description:
2025-01-30 08:19:42 dovecot_plain authenticator failed for ([103.146.233.121]) [103.146.233.121]:36613: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.225.53.149
description:
Jan 30 08:19:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.225.53.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 30 08:19:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 08:19:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.134.35
description:
Jan 30 08:20:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.18.238
description:
[2025-01-30 08:20:37 +0100] info [webmaild] 179.49.18.238 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 30 08:21:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-30 08:21:02 dovecot_plain authenticator failed for (pahum) [109.108.95.66]:53246: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.231.122.186
description:
[2025-01-30 08:20:09 +0100] info [webmaild] 170.231.122.186 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.134.35
description:
2025-01-30 08:20:21 dovecot_plain authenticator failed for (foringia) [78.186.134.35]:49279: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.72.85.234
description:
[2025-01-30 08:21:01 +0100] info [webmaild] 103.72.85.234 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 159.65.188.122
description:
[2025-01-30 08:22:07 +0100] info [whostmgrd] 159.65.188.122 - ait "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-01-30 08:21:21 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:36832: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-30 08:21:32 dovecot_login authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:54337: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.236.237
description:
2025-01-30 08:21:37 dovecot_plain authenticator failed for ([118.43.236.237]) [118.43.236.237]:60868: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.11
description:
2025-01-30 08:21:46 dovecot_plain authenticator failed for (ppp11-lumwana.zamnet.zm) [196.46.199.11]:46802: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.105.221.82
description:
Jan 30 08:21:49 ait sshd[764812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.105.221.82  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.11
description:
Jan 30 08:21:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Jan 30 08:21:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
description:
2025-01-30 08:21:20 dovecot_login authenticator failed for ([60.175.146.138]) [60.175.146.138]:34506: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
description:
Jan 30 08:21:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
description:
2025-01-30 08:21:41 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:50856: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 30 08:21:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.43.236.237
description:
Jan 30 08:21:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.43.236.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.175.146.138
description:
Jan 30 08:21:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.175.146.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.105.221.82
description:
Jan 30 08:21:49 ait sshd[764812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.105.221.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 30 08:22:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 30 08:22:50 ait sshd[765352]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 30 08:22:50 ait sshd[765352]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.101.128.156
description:
Jan 30 08:22:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.101.128.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-30 08:22:32 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:39588: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.128.156
description:
2025-01-30 08:22:25 dovecot_login authenticator failed for c-73-101-128-156.hsd1.pa.comcast.net [73.101.128.156]:32407: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.230.214.243
description:
2025-01-30 08:22:26 dovecot_plain authenticator failed for c-85-230-214-243.bbcust.telenor.se (nines) [85.230.214.243]:41677: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 08:23:01 ait sshd[765411]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.230.214.243
description:
Jan 30 08:22:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.230.214.243 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-22.15.206.171.64


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 08:23:01 ait sshd[765411]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Jan 30 08:23:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-01-30 08:23:46 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:58167: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 08:23:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
description:
Jan 30 08:23:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.54.19
description:
47.128.54.19 - - [30/Jan/2025:08:23:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20914570 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C106%2C30&filter_course-language=198%2C79%2C121&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.19


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.149.99
description:
[2025-01-30 08:23:56 +0100] info [webmaild] 177.67.149.99 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-01-30 08:23:36 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:46597: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.217.65.158
description:
[2025-01-30 08:24:44 +0100] info [webmaild] 102.217.65.158 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 30 08:24:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 30 08:25:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-30 08:24:24 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:41552: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-30 08:25:05 dovecot_plain authenticator failed for (heaveids) [109.166.70.166]:32489: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 30 08:24:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-30 08:24:14 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:40418: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.20.41.22
description:
[2025-01-30 08:24:27 +0100] info [webmaild] 190.20.41.22 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.82.102
description:
2025-01-30 08:26:01 dovecot_login authenticator failed for vps-926fddc5.vps.ovh.net [79.137.82.102]:40350: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 30 08:25:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.235.247.226
description:
[2025-01-30 08:25:20 +0100] info [webmaild] 201.235.247.226 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.220.241.252
description:
2025-01-30 08:25:20 dovecot_login authenticator failed for ([127.0.0.1]) [183.220.241.252]:52970: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.220.241.252
description:
Jan 30 08:25:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.220.241.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.32.82.32
description:
2025-01-30 08:25:26 dovecot_login authenticator failed for ([127.0.0.1]) [94.32.82.32]:39635: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 30 08:25:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-30 08:25:50 dovecot_login authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:58332: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Jan 30 08:25:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-01-30 08:25:54 dovecot_login authenticator failed for ([61.83.232.94]) [221.163.182.162]:46645: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-30 08:25:15 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:39436: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.32.82.32
description:
Jan 30 08:25:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.32.82.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.82.102
description:
Jan 30 08:25:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.82.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.184.18
description:
2025-01-30 08:26:36 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:48979: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.38.80.107
description:
Jan 30 08:26:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.38.80.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.178.158.132
description:
2025-01-30 08:26:41 dovecot_login authenticator failed for ([103.178.158.132]) [103.178.158.132]:55304: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-30 08:26:24 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (subugged) [54.38.80.107]:46704: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
description:
Jan 30 08:26:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.222.184.18
description:
Jan 30 08:26:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.222.184.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-30 08:26:51 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:40260: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
description:
2025-01-30 08:26:52 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:59962: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.178.158.132
description:
Jan 30 08:26:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.178.158.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 30 08:26:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.113.122.243
description:
Jan 30 08:27:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.113.122.243 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.127.215.202
description:
[2025-01-30 08:27:53 +0100] info [webmaild] 177.127.215.202 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.113.122.243
description:
2025-01-30 08:27:50 dovecot_plain authenticator failed for ([210.113.122.243]) [210.113.122.243]:33246: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.94.166.230
description:
Jan 30 08:27:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.94.166.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 30 08:27:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.166.230
description:
2025-01-30 08:27:38 dovecot_plain authenticator failed for ([220.94.166.230]) [220.94.166.230]:35580: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 30 08:27:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-30 08:27:32 dovecot_plain authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:15713: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-30 08:27:40 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:58307: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.152.26
description:
Jan 30 08:28:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.152.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.93.113.138
description:
Jan 30 08:28:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.93.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 30 08:28:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.100
description:
2025-01-30 08:28:29 dovecot_login authenticator failed for ([104.241.228.100]) [104.241.228.100]:43554: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
description:
2025-01-30 08:28:35 dovecot_login authenticator failed for ([218.21.243.58]) [218.21.243.58]:48688: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.208.110
description:
Jan 30 08:28:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.208.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.243.58
description:
Jan 30 08:28:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.243.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 30 08:28:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 148.222.192.179
description:
[2025-01-30 08:28:15 +0100] info [webmaild] 148.222.192.179 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.152.26
description:
2025-01-30 08:28:14 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.152.26]:35534: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-30 08:28:15 dovecot_login authenticator failed for ([41.93.113.138]) [41.93.113.138]:42376: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.83
description:
47.128.47.83 - - [30/Jan/2025:08:28:15 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5571967 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=73&id=81&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.83


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-30 08:28:16 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:40656: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.208.110
description:
2025-01-30 08:28:20 dovecot_login authenticator failed for ([127.0.0.1]) [5.77.208.110]:46590: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.100
description:
Jan 30 08:28:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.175.206
description:
[2025-01-30 08:29:07 +0100] info [webmaild] 186.194.175.206 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.199.75
description:
Jan 30 08:28:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.199.75 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.24.181
description:
[2025-01-30 08:28:41 +0100] info [webmaild] 186.224.24.181 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 30 08:28:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-30 08:28:59 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:55588: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.201.20
description:
Jan 30 08:29:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.201.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
description:
2025-01-30 08:30:05 dovecot_plain authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:49394: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
description:
Jan 30 08:29:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 30 08:29:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-30 08:29:18 dovecot_login authenticator failed for net-2-32-137-250.cust.vodafonedsl.it (net-2-32-137-250.cust.dsl.teletu.it) [2.32.137.250]:35344: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
description:
2025-01-30 08:29:58 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:53576: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 08:29:25 ait sshd[768181]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
description:
Jan 30 08:29:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 30 08:29:50 ait sshd[768219]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 30 08:29:24 ait sshd[768181]: Invalid user meelevenverliesbegeleiding.nl 2a02 from 111.231.56.128 port 50304


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 08:29:50 ait sshd[768219]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-30 08:29:15 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:53230: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.154.27
description:
Jan 30 08:29:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.154.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.165.170.41
description:
2025-01-30 08:29:46 dovecot_login authenticator failed for ([45.165.170.41]) [45.165.170.41]:33237: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.84.60
description:
Jan 30 08:30:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.84.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 08:29:25 ait sshd[768181]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.154.27
description:
2025-01-30 08:29:30 dovecot_plain authenticator failed for p83028-obmd01.osaka.ocn.ne.jp [180.7.154.27]:54027: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 30 08:29:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 30 08:30:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.114.245.123
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-30.185.114.245.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-30 08:30:57 dovecot_login authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:52144: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-30 08:31:00 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:43104: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 30 08:31:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 30 08:30:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-30 08:31:07 dovecot_login authenticator failed for (dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [95.79.108.51]:39137: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-30 08:30:40 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:53210: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 207.244.236.198
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-30.207.244.236.198


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 30 08:30:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-01-30 08:31:27 dovecot_login authenticator failed for ([91.122.31.214]) [91.122.31.214]:40861: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.163.64
description:
Jan 30 08:31:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.163.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.218.225.14
description:
Jan 30 08:31:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.218.225.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.125.100.102
description:
[2025-01-30 08:32:08 +0100] info [webmaild] 200.125.100.102 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.0.61.49
description:
Jan 30 08:31:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.0.61.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Jan 30 08:31:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.0.61.49
description:
2025-01-30 08:31:44 dovecot_login authenticator failed for ([27.0.61.49]) [27.0.61.49]:54158: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.63.59
description:
[2025-01-30 08:31:44 +0100] info [webmaild] 131.161.63.59 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.241.75
description:
[2025-01-30 08:32:23 +0100] info [webmaild] 138.219.241.75 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.132.12.81
description:
[2025-01-30 08:32:59 +0100] info [webmaild] 85.132.12.81 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 30 08:34:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-30 08:34:05 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:45294: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.97.109.192
description:
Jan 30 08:33:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.97.109.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
description:
2025-01-30 08:33:53 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:51547: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Jan 30 08:34:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-01-30 08:34:46 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:57022: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 159.65.188.122
description:
[2025-01-30 08:34:52 +0100] info [whostmgrd] 159.65.188.122 - ait "POST /login/ HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
description:
Jan 30 08:34:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-01-30 08:34:36 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:41222: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
description:
Jan 30 08:35:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 30 08:35:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.44.30
description:
Jan 30 08:35:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.44.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
description:
2025-01-30 08:35:25 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:35402: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
description:
2025-01-30 08:35:26 dovecot_login authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:33592: 535 Incorrect authentication data (set_id=jaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-30 08:35:35 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:44712: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 30 08:35:55 ait sshd[770820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.44.30
description:
2025-01-30 08:35:13 dovecot_login authenticator failed for cl-185-254-44-30.b4net.lt [185.254.44.30]:47802: 535 Incorrect authentication data (set_id=jaster@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
description:
Jan 30 08:35:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 173.225.243.165
description:
[2025-01-30 08:35:31 +0100] info [webmaild] 173.225.243.165 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 30 08:35:55 ait sshd[770820]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.48.164.149
description:
[2025-01-30 08:36:01 +0100] info [webmaild] 179.48.164.149 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.82.131.20
description:
Jan 30 08:36:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.82.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.106.224.79
description:
[2025-01-30 08:36:52 +0100] info [webmaild] 176.106.224.79 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.203.185.246
description:
[2025-01-30 08:36:19 +0100] info [webmaild] 177.203.185.246 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 08:36:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-36.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
description:
Jan 30 08:36:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.239.23.149
description:
Jan 30 08:36:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.239.23.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-30 08:36:35 dovecot_login authenticator failed for ([216.194.174.86]) [216.194.174.27]:6423: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.82.131.20
description:
2025-01-30 08:36:50 dovecot_login authenticator failed for ([184.82.131.20]) [184.82.131.20]:52446: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.120.120.17
description:
[2025-01-30 08:36:58 +0100] info [webmaild] 87.120.120.17 - ofei@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 30 08:36:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.239.23.149
description:
2025-01-30 08:36:34 dovecot_plain authenticator failed for ([91.239.23.149]) [91.239.23.149]:59892: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
description:
2025-01-30 08:36:44 dovecot_plain authenticator failed for ([189.57.81.137]) [186.201.54.90]:36901: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.51.150
description:
47.128.51.150 - - [30/Jan/2025:08:37:58 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9861860 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C205%2C125&filter_course-language=120%2C121%2C79%2C198%2C99%2C183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.51.150


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.82
description:
2025-01-30 08:38:03 dovecot_plain authenticator failed for ([58.230.236.82]) [58.230.236.82]:43178: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.21.5.139
description:
Jan 30 08:38:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.21.5.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.237.3
description:
Jan 30 08:38:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.237.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Jan 30 08:37:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
description:
Jan 30 08:37:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.100.248.64
description:
2025-01-30 08:38:02 dovecot_login authenticator failed for ([223.100.248.64]) [223.100.248.64]:38134: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
description:
2025-01-30 08:37:44 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:56112: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-01-30 08:37:54 dovecot_login authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:38692: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 30 08:37:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-30 08:37:58 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:52036: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.100.248.64
description:
Jan 30 08:38:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.100.248.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.82
description:
Jan 30 08:38:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.21.5.139
description:
2025-01-30 08:38:06 dovecot_login authenticator failed for (dynamic.isp.ooredoo.om) [5.21.5.139]:35274: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.62.15
description:
[2025-01-30 08:39:09 +0100] info [webmaild] 181.191.62.15 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.237.3
description:
2025-01-30 08:38:11 dovecot_login authenticator failed for (broadband-37.204-237-3.ip.moscow.rt.ru) [37.204.237.3]:48906: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 30 08:38:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Jan 30 08:38:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.48.36.197
description:
Jan 30 08:38:34 ait sshd[771719]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.48.36.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
description:
Jan 30 08:38:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-30 08:38:12 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:32972: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 08:38:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
description:
Jan 30 08:38:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.145
description:
Jan 30 08:38:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.237.145
description:
2025-01-30 08:38:43 dovecot_login authenticator failed for (static.bb.ill.59.92.234.29.bsnl.in) [106.222.237.145]:19887: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 30 08:38:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
description:
Jan 30 08:38:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
description:
2025-01-30 08:38:23 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:64199: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 30 08:38:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-30 08:38:29 dovecot_login authenticator failed for ([102.53.15.17]) [102.53.15.17]:60593: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-01-30 08:38:34 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:21252: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.36.197
description:
Jan 30 08:38:34 ait sshd[771719]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.48.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.229.218.230
description:
Jan 30 08:39:33 ait sshd[772018]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.218.230


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.78.103.217
description:
[2025-01-30 08:39:57 +0100] info [webmaild] 189.78.103.217 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-30 08:39:46 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:36632: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.129.166.136
description:
[2025-01-30 08:39:48 +0100] info [webmaild] 190.129.166.136 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.122.79
description:
Jan 30 08:39:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.122.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.122.79
description:
2025-01-30 08:39:16 dovecot_login authenticator failed for ([127.0.0.1]) [85.215.122.79]:50557: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.229.218.230
description:
Jan 30 08:39:33 ait sshd[772018]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.229.218.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-30 08:39:33 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:50210: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.250.139
description:
2025-01-30 08:40:06 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.250.139]:32708: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.207.155.166
description:
Jan 30 08:39:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.207.155.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.155.166
description:
2025-01-30 08:39:27 dovecot_login authenticator failed for ([127.0.0.1]) [102.207.155.166]:40980: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 30 08:39:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 30 08:39:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 08:40:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 15.235.203.152
description:
Jan 30 08:40:13 ait sshd[772405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.203.152


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.153.110
description:
Jan 30 08:40:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.153.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.185.26.213
description:
Jan 30 08:40:34 ait sshd[772588]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.185.26.213


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.234.212.4
description:
[2025-01-30 08:40:40 +0100] info [webmaild] 177.234.212.4 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.65
description:
47.128.52.65 - - [30/Jan/2025:08:40:35 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11298448 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30%2C125&filter_course-language=121%2C79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.213.205
description:
2025-01-30 08:40:32 dovecot_login authenticator failed for ([127.0.0.1]) [110.14.213.205]:57345: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.185.26.213
description:
Jan 30 08:40:34 ait sshd[772588]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.185.26.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.235.203.152
description:
Jan 30 08:40:13 ait sshd[772405]: pam_imunify(sshd:auth): [IM360_RBL] The IP 15.235.203.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.153.110
description:
2025-01-30 08:40:17 dovecot_login authenticator failed for ([91.72.153.110]) [91.72.153.110]:48480: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.249.179
description:
Jan 30 08:40:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.249.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.249.179
description:
2025-01-30 08:40:22 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.249.179]:47837: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.213.205
description:
Jan 30 08:40:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.213.205 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.186.1.172
description:
Jan 30 08:41:02 ait sshd[772726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.186.1.172


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.1.172
description:
Jan 30 08:41:02 ait sshd[772726]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.186.1.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.36.197
description:
Jan 30 08:41:08 ait sshd[772739]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.48.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.235.203.152
description:
Jan 30 08:41:55 ait sshd[772971]: pam_imunify(sshd:auth): [IM360_RBL] The IP 15.235.203.152 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.48.36.197
description:
Jan 30 08:41:08 ait sshd[772739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.48.36.197


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 15.235.203.152
description:
Jan 30 08:41:55 ait sshd[772971]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.203.152


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.48.36.197
description:
Jan 30 08:41:10 ait sshd[772739]: Failed password for invalid user temp from 83.48.36.197 port 48428 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 30 08:42:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.34.28
description:
Jan 30 08:42:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.34.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.34.28
description:
2025-01-30 08:42:33 dovecot_login authenticator failed for 96-1-34-28-staticipeast.wireless.telus.com [96.1.34.28]:35018: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.43.234.122
description:
[2025-01-30 08:43:05 +0100] info [webmaild] 186.43.234.122 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 30 08:42:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.8.143
description:
Jan 30 08:42:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.8.143 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 83.48.36.197
description:
Jan 30 08:42:27 ait sshd[773121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=83.48.36.197


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 08:42:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.8.143
description:
2025-01-30 08:42:41 dovecot_login authenticator failed for 111-70-8-143.emome-ip.hinet.net [111.70.8.143]:41047: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-30 08:42:16 dovecot_login authenticator failed for ([60.166.31.198]) [60.166.31.198]:46026: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
description:
Jan 30 08:42:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.67
description:
2025-01-30 08:42:22 dovecot_login authenticator failed for ([111.61.176.67]) [111.61.176.67]:51456: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.48.36.197
description:
Jan 30 08:42:27 ait sshd[773121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 83.48.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-30 08:42:41 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:51606: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 30 08:42:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-30 08:43:00 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:34362: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 83.48.36.197
description:
Jan 30 08:42:29 ait sshd[773121]: Failed password for invalid user debian from 83.48.36.197 port 48432 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 15.235.203.152
description:
Jan 30 08:43:29 ait sshd[773499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=15.235.203.152


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 30 08:43:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 15.235.203.152
description:
Jan 30 08:43:29 ait sshd[773499]: pam_imunify(sshd:auth): [IM360_RBL] The IP 15.235.203.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.133.183.9
description:
Jan 30 08:43:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.133.183.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.133.183.9
description:
2025-01-30 08:43:30 dovecot_plain authenticator failed for ([121.133.183.9]) [121.133.183.9]:48536: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.120.25.52
description:
[2025-01-30 08:43:32 +0100] info [webmaild] 187.120.25.52 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.65.252.77
description:
Jan 30 08:43:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.65.252.77 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.186.1.172
description:
Jan 30 08:43:22 ait sshd[773478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.186.1.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-30 08:43:36 dovecot_plain authenticator failed for (odponpin) [77.51.214.170]:57845: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.48.66.236
description:
[2025-01-30 08:43:49 +0100] info [webmaild] 182.48.66.236 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.1.172
description:
Jan 30 08:43:22 ait sshd[773478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.186.1.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.65.252.77
description:
2025-01-30 08:43:55 dovecot_plain authenticator failed for ([181.65.252.77]) [181.65.252.77]:45902: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.106.148.77
description:
[2025-01-30 08:44:24 +0100] info [webmaild] 85.106.148.77 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-44.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 08:44:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.186.1.172
description:
Jan 30 08:44:59 ait sshd[774260]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.186.1.172


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.186.1.172
description:
Jan 30 08:44:59 ait sshd[774260]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.186.1.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 30 08:45:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-30 08:45:50 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:56137: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
description:
Jan 30 08:46:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 08:45:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 30 08:45:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-30 08:45:58 dovecot_plain authenticator failed for ([218.22.187.68]) [218.22.187.66]:33046: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 30 08:47:05 ait sshd[775355]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.132.41.172
description:
Jan 30 08:46:41 ait sshd[775271]: pam_imunify(sshd:auth): [IM360_RBL] The IP 161.132.41.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.132.41.172
description:
Jan 30 08:46:41 ait sshd[775271]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.132.41.172  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
description:
2025-01-30 08:46:09 dovecot_plain authenticator failed for ([49.249.76.221]) [49.249.76.221]:57228: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.230.94.235
description:
[2025-01-30 08:46:51 +0100] info [webmaild] 88.230.94.235 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 30 08:47:05 ait sshd[775355]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.91.107.199
description:
[2025-01-30 08:47:13 +0100] info [cpaneld] 138.91.107.199 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 30 08:47:47 ait sshd[775598]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 30 08:48:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 30 08:47:47 ait sshd[775598]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.142.97.56
description:
[2025-01-30 08:47:40 +0100] info [webmaild] 102.142.97.56 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.229.218.230
description:
Jan 30 08:47:47 ait sshd[775600]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.229.218.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-30 08:48:02 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (wometae) [91.200.226.218]:53490: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.98.129.85
description:
[2025-01-30 08:47:23 +0100] info [webmaild] 103.98.129.85 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.229.218.230
description:
Jan 30 08:47:47 ait sshd[775600]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.218.230  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
description:
Jan 30 08:49:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.222.212
description:
[2025-01-30 08:48:15 +0100] info [webmaild] 177.8.222.212 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.75.165.53
description:
Jan 30 08:48:28 ait sshd[775838]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.75.165.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.75.165.53
description:
Jan 30 08:48:28 ait sshd[775838]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.75.165.53  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.8.28.72
description:
Jan 30 08:50:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.8.28.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
description:
2025-01-30 08:49:10 dovecot_plain authenticator failed for ([60.216.37.11]) [60.216.37.11]:35900: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 30 08:49:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.8.28.72
description:
2025-01-30 08:50:02 dovecot_login authenticator failed for host-188-8-28-72.business.telecomitalia.it ([127.0.0.1]) [188.8.28.72]:45984: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 30 08:50:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-30 08:50:08 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:59288: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 161.132.41.172
description:
Jan 30 08:49:09 ait sshd[776274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 161.132.41.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 08:49:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-30 08:49:44 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:51938: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 161.132.41.172
description:
Jan 30 08:49:09 ait sshd[776274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=161.132.41.172  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.68.154.21
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads17b00155y@ait.edu.gh||WPU:ads17b00155y@ait.edu.gh||RSV:6.65||T:APACHE||MV:08-49.185.68.154.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 08:50:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
description:
2025-01-30 08:50:42 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:49942: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-50.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.216.233.188
description:
2025-01-30 08:50:50 dovecot_plain authenticator failed for ([178.216.233.188]) [178.216.233.188]:48081: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.142.16.49
description:
[2025-01-30 08:50:53 +0100] info [webmaild] 195.142.16.49 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.213
description:
Jan 30 08:51:32 ait sshd[777325]: error: maximum authentication attempts exceeded for root from 218.92.0.213 port 29498 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.33.120
description:
[2025-01-30 08:51:42 +0100] info [webmaild] 45.70.33.120 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Jan 30 08:51:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-01-30 08:51:58 dovecot_login authenticator failed for ([60.31.249.131]) [60.31.249.131]:60995: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.213
description:
Jan 30 08:51:09 ait sshd[777325]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.213 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.213
description:
Jan 30 08:51:09 ait sshd[777325]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.213  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.110.195.4
description:
[2025-01-30 08:51:32 +0100] info [webmaild] 152.110.195.4 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-30 08:51:38 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:52268: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 08:51:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 30 08:52:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.44.61.219
description:
[2025-01-30 08:52:23 +0100] info [webmaild] 187.44.61.219 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.250.226
description:
Jan 30 08:52:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.250.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.163.236.235
description:
2025-01-30 08:53:05 dovecot_login authenticator failed for ([127.0.0.1]) [222.163.236.235]:40316: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-30 08:52:18 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (proscus) [81.225.30.107]:44557: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.250.226
description:
2025-01-30 08:52:53 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.250.226]:32932: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.125.67.109
description:
2025-01-30 08:52:55 dovecot_plain authenticator failed for ([39.125.67.109]) [39.125.67.109]:35898: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.163.236.235
description:
Jan 30 08:53:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.163.236.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 30 08:53:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-30 08:53:07 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:49066: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-30 08:53:10 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:62612: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.229.218.230
description:
Jan 30 08:53:58 ait sshd[778471]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.229.218.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.229.218.230
description:
Jan 30 08:53:58 ait sshd[778471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.229.218.230


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 08:53:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.204.22
description:
2025-01-30 08:53:17 dovecot_plain authenticator failed for ([196.46.204.22]) [196.46.204.22]:45496: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-30 08:54:04 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:56574: 535 Incorrect authentication data (set_id=jaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.249
description:
2025-01-30 08:53:54 dovecot_login authenticator failed for 249.151.48.116.static.netvigator.com [116.48.151.249]:61236: 535 Incorrect authentication data (set_id=jaster@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 30 08:54:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.204.22
description:
Jan 30 08:53:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.50
description:
Jan 30 08:54:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-01-30 08:54:29 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:60674: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.239.164.190
description:
2025-01-30 08:54:30 dovecot_plain authenticator failed for (sogaz-gw.irkutsk.gldn.net) [195.239.164.190]:36204: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.190.234.169
description:
[2025-01-30 08:54:37 +0100] info [webmaild] 45.190.234.169 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.50
description:
2025-01-30 08:54:14 dovecot_plain authenticator failed for ([61.185.68.50]) [61.185.68.50]:48192: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.78.70
description:
Jan 30 08:54:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.78.70
description:
2025-01-30 08:54:26 dovecot_plain authenticator failed for 80-15-78-70.ftth.fr.orangecustomers.net (raided) [80.15.78.70]:37480: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Jan 30 08:54:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.192
description:
Jan 30 08:54:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.192
description:
2025-01-30 08:54:19 dovecot_plain authenticator failed for (189.218.168.192-clientes-izzi.mx) [189.218.168.192]:56215: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.239.164.190
description:
Jan 30 08:54:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.239.164.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 30 08:55:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-01-30 08:55:54 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:52786: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.189.42
description:
Jan 30 08:56:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.189.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.189.42
description:
2025-01-30 08:56:08 dovecot_plain authenticator failed for ([183.234.189.42]) [183.234.189.42]:45492: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 08:55:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.97.137.9
description:
[2025-01-30 08:55:31 +0100] info [webmaild] 105.97.137.9 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
description:
Jan 30 08:55:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.20.61.155
description:
[2025-01-30 08:55:25 +0100] info [webmaild] 190.20.61.155 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Jan 30 08:55:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
description:
2025-01-30 08:55:46 dovecot_plain authenticator failed for (mandionis) [37.139.110.118]:54317: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-30 08:55:49 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com (baphir) [46.162.74.47]:57816: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 30 08:57:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.30.176.109
description:
2025-01-30 08:57:06 dovecot_plain authenticator failed for ([113.30.176.109]) [113.30.176.109]:52406: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.250.134.35
description:
2025-01-30 08:56:28 dovecot_login authenticator failed for ([130.250.134.35]) [130.250.134.35]:41708: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.224.227
description:
Jan 30 08:56:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.224.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.224.227
description:
2025-01-30 08:57:00 dovecot_plain authenticator failed for ([220.120.224.227]) [220.120.224.227]:60436: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.30.176.109
description:
Jan 30 08:57:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.30.176.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.250.134.35
description:
Jan 30 08:56:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.250.134.35 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:08-56.103.249.112.157


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.227.203
description:
2025-01-30 08:56:38 dovecot_login authenticator failed for ([118.70.227.203]) [118.70.227.203]:39191: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 08:56:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.227.203
description:
Jan 30 08:56:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.227.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-30 08:57:06 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:57470: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.71.95.81
description:
[2025-01-30 08:56:23 +0100] info [webmaild] 41.71.95.81 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.207.134
description:
2025-01-30 08:57:13 dovecot_plain authenticator failed for ([221.2.207.134]) [221.2.207.134]:54615: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 30 08:57:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-01-30 08:57:50 dovecot_login authenticator failed for (119.93.87.71.static.pldt.net) [119.93.87.71]:24259: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.78
description:
Jan 30 08:58:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.39.187.16
description:
2025-01-30 08:57:16 dovecot_plain authenticator failed for ([189.39.187.16]) [189.39.187.16]:47100: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-30 08:57:32 dovecot_login authenticator failed for ([14.97.7.138]) [182.71.173.250]:55154: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-01-30 08:57:43 dovecot_plain authenticator failed for ([61.51.184.194]) [61.51.184.194]:53589: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-01-30 08:57:44 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:56472: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 30 08:58:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
description:
Jan 30 08:57:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.39.187.16
description:
Jan 30 08:57:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.39.187.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
description:
2025-01-30 08:57:17 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:39553: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-01-30 08:58:03 dovecot_login authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:49239: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.78
description:
2025-01-30 08:58:07 dovecot_login authenticator failed for ([111.61.176.78]) [111.61.176.78]:12644: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.217.86
description:
Jan 30 08:57:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.217.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
description:
2025-01-30 08:57:11 dovecot_plain authenticator failed for ([183.167.217.86]) [183.167.217.86]:53523: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
description:
Jan 30 08:57:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Jan 30 08:57:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 30 08:57:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.93.87.71
description:
Jan 30 08:57:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.93.87.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-01-30 08:58:49 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:44402: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-30 08:58:57 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:54134: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.184.38
description:
[2025-01-30 08:59:05 +0100] info [webmaild] 177.129.184.38 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Jan 30 08:59:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-01-30 08:59:09 dovecot_login authenticator failed for ([116.113.254.26]) [116.113.254.26]:34018: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Jan 30 08:58:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-01-30 08:58:12 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:55329: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Jan 30 08:58:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 30 08:58:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.250.129.32
description:
Jan 30 08:59:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.250.129.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.250.129.32
description:
2025-01-30 08:59:04 dovecot_plain authenticator failed for ([219.250.129.32]) [219.250.129.32]:50168: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.179.80.12
description:
Jan 30 08:58:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.179.80.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.80.12
description:
2025-01-30 08:58:27 dovecot_plain authenticator failed for ([186.179.80.12]) [186.179.80.12]:51968: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.95.127.219
description:
[2025-01-30 08:58:19 +0100] info [webmaild] 179.95.127.219 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 30 08:59:17 ait sshd[780739]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 30 08:59:17 ait sshd[780739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.109.220.10
description:
[2025-01-30 08:59:19 +0100] info [webmaild] 187.109.220.10 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 08:59:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 09:00:51 ait sshd[781663]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
description:
2025-01-30 09:00:57 dovecot_login authenticator failed for (m121-202-155-16.smartone.com) [121.202.155.16]:37575: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-30 09:01:03 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (peter) [91.200.226.218]:41288: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.47.74.210
description:
Jan 30 09:00:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.47.74.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Jan 30 09:00:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.111.22
description:
Jan 30 09:01:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.111.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.209.71
description:
[2025-01-30 09:00:12 +0100] info [webmaild] 45.164.209.71 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-30 09:00:41 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:13454: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
description:
Jan 30 09:00:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 30 09:00:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 09:00:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.47.74.210
description:
2025-01-30 09:00:42 dovecot_login authenticator failed for ([103.47.74.210]) [103.47.74.210]:57018: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 09:00:51 ait sshd[781663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 30 09:01:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.111.22
description:
2025-01-30 09:01:02 dovecot_login authenticator failed for ([110.34.111.22]) [110.34.111.22]:43137: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 09:00:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-30 09:01:15 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:55328: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-30 09:01:49 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:55966: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 30 09:01:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Jan 30 09:01:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 30 09:01:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-30 09:01:54 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (destines) [91.200.226.218]:46124: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 30 09:01:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 09:02:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 30 09:02:18 ait sshd[782123]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.68.109.65
description:
[2025-01-30 09:02:19 +0100] info [webmaild] 102.68.109.65 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.137
description:
Jan 30 09:02:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.137 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 171.244.129.243
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-02.171.244.129.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-01-30 09:02:32 dovecot_login authenticator failed for ([195.252.209.189]) [195.252.209.189]:47543: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.29.101
description:
2025-01-30 09:02:15 dovecot_login authenticator failed for (doserver.womenpla.net) [139.59.29.101]:59918: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 30 09:02:15 ait sshd[782114]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 30 09:02:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-30 09:02:27 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:48590: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.137
description:
2025-01-30 09:02:31 dovecot_plain authenticator failed for (frackelate) [65.20.251.137]:33192: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 30 09:03:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-30 09:03:03 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:36428: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.29.101
description:
Jan 30 09:02:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.29.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 30 09:02:15 ait sshd[782114]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 30 09:02:18 ait sshd[782123]: Invalid user meelevenverliesbegeleiding.nl 2a02 from 111.231.56.128 port 41308


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 30 09:02:18 ait sshd[782123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Jan 30 09:02:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.67.218.130
description:
[2025-01-30 09:03:05 +0100] info [webmaild] 177.67.218.130 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Jan 30 09:03:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.199.20
description:
Jan 30 09:03:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.199.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 30 09:03:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-01-30 09:04:03 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:33309: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-01-30 09:03:13 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:50959: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.11.137.161
description:
[2025-01-30 09:03:31 +0100] info [webmaild] 46.11.137.161 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.199.20
description:
2025-01-30 09:03:49 dovecot_plain authenticator failed for ([157.122.199.20]) [157.122.199.20]:35439: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-30 09:03:59 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:38198: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Jan 30 09:04:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.217.99.141
description:
[2025-01-30 09:04:11 +0100] info [webmaild] 103.217.99.141 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
description:
2025-01-30 09:04:17 dovecot_plain authenticator failed for (nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:38986: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.132.246
description:
Jan 30 09:04:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 30 09:04:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-30 09:04:44 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (soaroze) [81.225.30.107]:53004: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-05.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.160
description:
Jan 30 09:04:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.132.246
description:
2025-01-30 09:04:39 dovecot_plain authenticator failed for c188-149-132-246.bredband.tele2.se (unmelleurd) [188.149.132.246]:40272: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-01-30 09:05:34 dovecot_plain authenticator failed for ([188.226.47.211]) [188.226.47.211]:58884: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 30 09:05:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-06.157.230.172.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Jan 30 09:05:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-05.103.249.112.157


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-30 09:05:44 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:29472: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
description:
2025-01-30 09:06:32 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:60916: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.150.88.37
description:
Jan 30 09:06:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.150.88.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.185.10.173
description:
Jan 30 09:06:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 146.185.10.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.185.10.173
description:
2025-01-30 09:06:29 dovecot_login authenticator failed for ([127.0.0.1]) [146.185.10.173]:56888: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
description:
Jan 30 09:06:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.216.81.126
description:
2025-01-30 09:06:46 dovecot_login authenticator failed for ([196.216.81.126]) [196.216.81.126]:34662: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-01-30 09:06:59 dovecot_login authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:45924: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.114.194
description:
2025-01-30 09:06:23 dovecot_login authenticator failed for ([127.0.0.1]) [186.233.114.194]:59050: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.233.173.54
description:
[2025-01-30 09:06:23 +0100] info [webmaild] 45.233.173.54 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.77.209.27
description:
2025-01-30 09:06:47 dovecot_login authenticator failed for ([127.0.0.1]) [5.77.209.27]:54718: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Jan 30 09:06:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.10.79.34
description:
Jan 30 09:06:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.10.79.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.79.34
description:
2025-01-30 09:07:01 dovecot_plain authenticator failed for ([59.10.79.34]) [59.10.79.34]:47514: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.233.114.194
description:
Jan 30 09:06:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.233.114.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.150.88.37
description:
2025-01-30 09:06:41 dovecot_login authenticator failed for ([127.0.0.1]) [121.150.88.37]:44778: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.216.81.126
description:
Jan 30 09:06:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.216.81.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.77.209.27
description:
Jan 30 09:06:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.77.209.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.22.230.189
description:
[2025-01-30 09:07:13 +0100] info [webmaild] 46.22.230.189 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-30 09:07:56 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:43398: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.197.38
description:
2025-01-30 09:07:12 dovecot_plain authenticator failed for ([117.211.197.38]) [117.211.197.38]:60834: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.196.162
description:
Jan 30 09:07:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.196.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-30 09:07:59 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:45250: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.46.18
description:
[2025-01-30 09:07:11 +0100] info [webmaild] 179.189.46.18 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.241.61
description:
Jan 30 09:07:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.241.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 30 09:07:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 30 09:07:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
description:
2025-01-30 09:07:58 dovecot_login authenticator failed for ([220.95.14.102]) [220.95.14.102]:38864: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.191.221.158
description:
Jan 30 09:07:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.191.221.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-30 09:08:09 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:35478: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.241.61
description:
2025-01-30 09:07:36 dovecot_plain authenticator failed for (nsg-corporate-61.241.187.122.airtel.in) [122.187.241.61]:46138: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
description:
2025-01-30 09:07:48 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.196.162]:64112: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.87.165.32
description:
[2025-01-30 09:08:07 +0100] info [webmaild] 187.87.165.32 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.15.121
description:
Jan 30 09:08:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.15.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.211.197.38
description:
Jan 30 09:07:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.211.197.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 30 09:07:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-30 09:07:25 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:25566: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.191.221.158
description:
2025-01-30 09:07:49 dovecot_plain authenticator failed for syn-075-191-221-158.res.spectrum.com [75.191.221.158]:38735: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 30 09:08:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Jan 30 09:07:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-30 09:08:55 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:24565: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 134.209.206.168
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-09.134.209.206.168


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.147
description:
Jan 30 09:08:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 09:08:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.184.119.61
description:
2025-01-30 09:09:09 dovecot_login authenticator failed for ([61.184.119.61]) [61.184.119.61]:41556: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.255.15.121
description:
2025-01-30 09:08:11 dovecot_login authenticator failed for ([103.255.15.121]) [103.255.15.121]:50880: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.147
description:
2025-01-30 09:08:31 dovecot_plain authenticator failed for (sivents) [65.20.205.147]:44047: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.184.119.61
description:
Jan 30 09:09:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.184.119.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 30 09:08:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-30 09:08:23 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:10009: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 30 09:08:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Jan 30 09:09:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-01-30 09:09:27 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:58485: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.226.68.250
description:
Jan 30 09:09:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.226.68.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 30 09:10:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.226.68.250
description:
2025-01-30 09:09:52 dovecot_login authenticator failed for syn-072-226-068-250.res.spectrum.com [72.226.68.250]:57198: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-30 09:10:07 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:35484: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-30 09:10:10 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:50346: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.20.66
description:
2025-01-30 09:09:16 dovecot_login authenticator failed for ([94.200.20.66]) [94.200.20.66]:33928: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.86.246.253
description:
[2025-01-30 09:10:04 +0100] info [webmaild] 187.86.246.253 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
description:
Jan 30 09:09:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 30 09:10:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
description:
2025-01-30 09:10:20 dovecot_login authenticator failed for ([5.32.107.6]) [5.32.107.6]:49561: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.47.160.21
description:
[2025-01-30 09:10:51 +0100] info [webmaild] 5.47.160.21 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
description:
Jan 30 09:10:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.68.16
description:
[2025-01-30 09:11:02 +0100] info [webmaild] 170.245.68.16 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.49
description:
[2025-01-30 09:11:20 +0100] info [cpaneld] 156.228.90.49 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00244y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.59.252
description:
[2025-01-30 09:11:22 +0100] info [whostmgrd] 104.207.59.252 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.119.110
description:
[2025-01-30 09:11:24 +0100] info [whostmgrd] 156.228.119.110 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-30 09:11:42 dovecot_plain authenticator failed for (dingemic) [102.53.15.18]:36901: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


