# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.194.181.238
description:
Jan 27 15:20:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.194.181.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Jan 27 15:20:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
description:
2025-01-27 15:20:08 dovecot_plain authenticator failed for (113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:40613: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.166.2
description:
Jan 27 15:20:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Jan 27 15:20:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-01-27 15:20:24 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:49174: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.105.126.17
description:
[2025-01-27 15:20:26 +0100] info [webmaild] 193.105.126.17 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.194.181.238
description:
2025-01-27 15:20:31 dovecot_plain authenticator failed for ([175.194.181.238]) [175.194.181.238]:52115: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-01-27 15:20:35 dovecot_plain authenticator failed for ([200.222.80.81]) [200.222.90.178]:49013: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.91.165
description:
Jan 27 15:21:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.91.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.91.165
description:
2025-01-27 15:21:18 dovecot_login authenticator failed for ([65.76.91.165]) [65.76.91.165]:43950: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-27 15:21:31 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:41116: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.47.95
description:
2025-01-27 15:21:54 dovecot_plain authenticator failed for p387096-obmd01.tokyo.ocn.ne.jp [60.45.47.95]:44207: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 27 15:21:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.186.33.55
description:
Jan 27 15:21:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.186.33.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.186.33.55
description:
2025-01-27 15:21:37 dovecot_plain authenticator failed for (h55.33.186.173.dynamic.ip.windstream.net) [173.186.33.55]:43396: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.45.47.95
description:
Jan 27 15:21:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.45.47.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 27 15:21:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-27 15:21:10 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:63056: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/images/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.45.187.190
description:
[2025-01-27 15:21:21 +0100] info [webmaild] 77.45.187.190 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/data1/images/js/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.245.10.228
description:
Jan 27 15:22:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.245.10.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.245.10.228
description:
2025-01-27 15:22:03 dovecot_plain authenticator failed for ([49.245.10.228]) [49.245.10.228]:34611: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.37.133
description:
[2025-01-27 15:22:30 +0100] info [webmaild] 177.185.37.133 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.190.150.4
description:
Jan 27 15:23:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.190.150.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 27 15:23:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.105.206
description:
Jan 27 15:23:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.105.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.190.150.4
description:
2025-01-27 15:23:03 dovecot_login authenticator failed for ([203.190.150.4]) [203.190.150.4]:41062: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/engine1/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 15:23:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 15:23:15 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:26716: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.92.36
description:
[2025-01-27 15:23:38 +0100] info [webmaild] 84.54.92.36 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
description:
Jan 27 15:23:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.105.206
description:
2025-01-27 15:23:53 dovecot_login authenticator failed for ([60.173.105.206]) [60.173.105.206]:57721: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.216.125
description:
Jan 27 15:23:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.216.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.168.60.70
description:
[2025-01-27 15:24:00 +0100] info [webmaild] 187.168.60.70 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 27 15:23:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-27 15:23:31 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:52846: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
description:
2025-01-27 15:23:44 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:57617: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-27 15:23:41 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:56126: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.216.125
description:
2025-01-27 15:23:59 dovecot_plain authenticator failed for (nl125-twinpalm-216-lk.zamnet.zm) [196.46.216.125]:38234: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-01-27 15:24:47 dovecot_plain authenticator failed for ([116.113.254.26]) [116.113.254.26]:59374: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-01-27 15:24:50 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:33679: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 15:24:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.121.147
description:
Jan 27 15:24:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.121.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Jan 27 15:24:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.68.153.94
description:
2025-01-27 15:24:26 dovecot_plain authenticator failed for ([150.242.239.128]) [222.68.153.94]:43000: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-01-27 15:24:28 dovecot_login authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:52557: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Jan 27 15:24:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/css/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Jan 27 15:24:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
description:
2025-01-27 15:24:34 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:51918: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.249
description:
2025-01-27 15:24:59 dovecot_login authenticator failed for ([104.241.237.249]) [104.241.237.249]:54479: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.249
description:
Jan 27 15:24:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.121.147
description:
2025-01-27 15:24:10 dovecot_plain authenticator failed for (82.193.121.147.ipnet.ua) [82.193.121.147]:38620: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Jan 27 15:24:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-01-27 15:24:19 dovecot_plain authenticator failed for (95.0.252.76.static.ttnet.com.tr) [95.0.252.76]:39660: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.68.153.94
description:
Jan 27 15:24:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.68.153.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-01-27 15:24:25 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:58517: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
description:
Jan 27 15:24:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Jan 27 15:24:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
description:
Jan 27 15:24:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
description:
2025-01-27 15:24:55 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:47668: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 27 15:25:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 27 15:25:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/css/images/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Jan 27 15:25:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
description:
Jan 27 15:25:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
description:
Jan 27 15:25:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
description:
2025-01-27 15:25:40 dovecot_login authenticator failed for ([116.113.254.26]) [116.113.254.26]:47404: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
description:
2025-01-27 15:25:40 dovecot_plain authenticator failed for ([41.214.10.178]) [41.214.10.178]:51128: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
description:
2025-01-27 15:25:50 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:36698: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-27 15:25:51 dovecot_login authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:41384: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 27 15:25:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Jan 27 15:25:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-27 15:25:54 dovecot_login authenticator failed for ([1.212.225.99]) [1.212.225.99]:38586: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-27 15:25:16 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:48144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
description:
Jan 27 15:25:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
description:
2025-01-27 15:25:38 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:8360: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Jan 27 15:25:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-01-27 15:25:23 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:7250: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.93.156.147
description:
Jan 27 15:26:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.93.156.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.170.97.94
description:
Jan 27 15:26:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.170.97.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 27 15:26:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/data1/images/css/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.192.17.153
description:
[2025-01-27 15:26:14 +0100] info [webmaild] 177.192.17.153 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.145.169.138
description:
Jan 27 15:26:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.145.169.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.145.169.138
description:
2025-01-27 15:26:50 dovecot_plain authenticator failed for ([58.145.169.138]) [58.145.169.138]:33634: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.93.156.147
description:
2025-01-27 15:26:05 dovecot_plain authenticator failed for ip4-193-93-156-147.blue-net.com.pl ([193.93.156.149]) [193.93.156.147]:47756: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.161.176.2
description:
[2025-01-27 15:26:11 +0100] info [webmaild] 131.161.176.2 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 27 15:26:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-27 15:26:58 dovecot_plain authenticator failed for ([94.204.192.242]) [94.204.192.242]:40580: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-27 15:26:05 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:52433: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-01-27 15:26:13 dovecot_plain authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:41044: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Jan 27 15:26:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
description:
2025-01-27 15:26:49 dovecot_plain authenticator failed for (abts-mum-static-094.97.170.122.airtelbroadband.in) [122.170.97.94]:46449: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-27 15:27:08 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:38971: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-01-27 15:27:23 dovecot_plain authenticator failed for ([1.180.230.98]) [1.180.230.98]:41282: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 27 15:27:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-27 15:27:55 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:22245: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.95.161.26
description:
Jan 27 15:27:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.95.161.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-01-27 15:27:36 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:41624: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.169
description:
Jan 27 15:27:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Jan 27 15:27:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Jan 27 15:27:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 27 15:27:21 ait sshd[3017137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.144.38
description:
2025-01-27 15:27:28 dovecot_plain authenticator failed for ([45.179.144.38]) [45.179.144.38]:56762: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Jan 27 15:27:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.168.111.80
description:
Jan 27 15:27:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.168.111.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.90.43
description:
Jan 27 15:27:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.90.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/css/js/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.109.12.35
description:
[2025-01-27 15:27:50 +0100] info [webmaild] 190.109.12.35 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
description:
2025-01-27 15:27:55 dovecot_login authenticator failed for (cust-72-26-178-196.wireless.t6b.com) [72.26.178.196]:39538: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 27 15:27:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.168.111.80
description:
2025-01-27 15:27:12 dovecot_plain authenticator failed for 80.111.168.125.sta.wbroadband.net.au [125.168.111.80]:42852: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 27 15:27:21 ait sshd[3017137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.144.38
description:
Jan 27 15:27:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.144.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-01-27 15:27:02 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:61845: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 27 15:27:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.169
description:
2025-01-27 15:27:46 dovecot_plain authenticator failed for ([220.77.182.169]) [220.77.182.169]:58410: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.90.43
description:
2025-01-27 15:27:13 dovecot_plain authenticator failed for ([39.174.90.48]) [39.174.90.43]:42437: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.95.161.26
description:
2025-01-27 15:27:16 dovecot_plain authenticator failed for ([223.95.161.26]) [223.95.161.26]:58506: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 211.108.234.111
description:
Jan 27 15:27:21 ait sshd[3017137]: Invalid user universitypublishing from 211.108.234.111 port 57584


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 15:28:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 27 15:28:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.159.114
description:
2025-01-27 15:28:42 dovecot_plain authenticator failed for p88115-obmd01.osaka.ocn.ne.jp [180.7.159.114]:35162: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 27 15:28:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-27 15:28:55 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:57623: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 15:28:06 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:32935: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.38.26.56
description:
[2025-01-27 15:28:16 +0100] info [webmaild] 179.38.26.56 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-27 15:28:22 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:53758: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
description:
2025-01-27 15:28:30 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:36196: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.37
description:
Jan 27 15:28:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 27 15:28:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-27 15:28:14 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:59144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
description:
Jan 27 15:28:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.37
description:
2025-01-27 15:28:43 dovecot_plain authenticator failed for ([101.13.5.37]) [101.13.5.37]:41556: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 15:29:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/css/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-01-27 15:29:18 dovecot_plain authenticator failed for ([50.188.204.213]) [50.188.204.213]:55863: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Jan 27 15:29:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-01-27 15:29:32 dovecot_plain authenticator failed for ([117.175.160.29]) [117.175.160.29]:39222: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Jan 27 15:29:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.193.72
description:
Jan 27 15:30:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.193.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.193.72
description:
2025-01-27 15:30:31 dovecot_plain authenticator failed for ([39.152.193.72]) [39.152.193.72]:44534: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 27 15:30:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-27 15:30:45 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:58788: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.158.26.59
description:
2025-01-27 15:30:09 dovecot_plain authenticator failed for ([195.158.26.59]) [195.158.26.59]:37362: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 27 15:31:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.193.106.140
description:
Jan 27 15:31:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.193.106.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.193.106.140
description:
2025-01-27 15:32:00 dovecot_plain authenticator failed for ([122.193.106.140]) [122.193.106.140]:35742: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.51.242.119
description:
Jan 27 15:31:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.51.242.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.242.119
description:
2025-01-27 15:31:25 dovecot_plain authenticator failed for ([58.244.99.85]) [119.51.242.119]:39294: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
description:
Jan 27 15:31:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.150.178
description:
Jan 27 15:31:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.150.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.126
description:
Jan 27 15:31:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.126
description:
2025-01-27 15:31:55 dovecot_plain authenticator failed for ([222.170.255.126]) [222.170.255.126]:43552: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.154.149
description:
Jan 27 15:31:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.154.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.154.149
description:
2025-01-27 15:31:14 dovecot_plain authenticator failed for ([175.156.154.149]) [175.156.154.149]:37934: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/images/data1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-01-27 15:31:45 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:52812: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.87.251
description:
2025-01-27 15:32:00 dovecot_plain authenticator failed for ([183.234.87.251]) [183.234.87.251]:38901: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.66.251
description:
2025-01-27 15:31:02 dovecot_plain authenticator failed for ([120.236.66.251]) [120.236.66.251]:47193: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-27 15:31:35 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:59739: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.150.178
description:
2025-01-27 15:31:47 dovecot_plain authenticator failed for ([178.46.150.178]) [178.46.150.178]:39544: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.87.251
description:
Jan 27 15:31:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.87.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.66.251
description:
Jan 27 15:31:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.66.251 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.219
description:
Jan 27 15:32:07 ait sshd[3020364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.219  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 15:32:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.178.251.33
description:
2025-01-27 15:32:37 dovecot_plain authenticator failed for ([210.178.251.33]) [210.178.251.33]:47548: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.181.81.77
description:
2025-01-27 15:32:05 dovecot_plain authenticator failed for ([125.181.81.77]) [125.181.81.77]:3333: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.219
description:
Jan 27 15:32:07 ait sshd[3020364]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.180
description:
Jan 27 15:32:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 27 15:32:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.195
description:
Jan 27 15:32:57 ait sshd[3020900]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.195
description:
Jan 27 15:32:57 ait sshd[3020900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.195


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/data1/images/css/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.181.81.77
description:
Jan 27 15:32:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.181.81.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.180
description:
2025-01-27 15:32:18 dovecot_plain authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:48717: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-27 15:32:25 dovecot_plain authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:36235: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.178.251.33
description:
Jan 27 15:32:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.178.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.117.63.33
description:
[2025-01-27 15:33:36 +0100] info [webmaild] 87.117.63.33 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
description:
Jan 27 15:33:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
description:
Jan 27 15:33:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-01-27 15:33:46 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:44284: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
description:
2025-01-27 15:33:57 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:36170: 535 Incorrect authentication data (set_id=awadzie)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/data1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.60.16
description:
47.128.60.16 - - [27/Jan/2025:15:33:09 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8746927 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/174319?panel=logger" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.60.16


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/data1/images/css/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.41.69.130
description:
2025-01-27 15:34:27 dovecot_plain authenticator failed for syn-047-041-069-130.res.spectrum.com [47.41.69.130]:58425: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-01-27 15:34:48 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:33978: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Jan 27 15:34:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.41.69.130
description:
Jan 27 15:34:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.41.69.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Jan 27 15:34:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 27 15:34:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-27 15:34:51 dovecot_plain authenticator failed for (ppp-82-84-122-203.dialup.tiscali.it) [82.84.122.203]:61844: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-01-27 15:34:58 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:60416: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.207.131
description:
[2025-01-27 15:36:35 +0100] info [webmaild] 45.171.207.131 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 27 15:36:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-27 15:36:43 dovecot_plain authenticator failed for (pretipil) [89.23.210.188]:34332: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-01-27 15:37:05 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:38014: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.99.94
description:
2025-01-27 15:37:32 dovecot_plain authenticator failed for ([65.76.99.94]) [65.76.99.94]:58236: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.219.110.215
description:
2025-01-27 15:37:50 dovecot_plain authenticator failed for 124-219-110-215.vdslpro.static.apol.com.tw [124.219.110.215]:46270: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/js/css/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-01-27 15:37:20 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:58181: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.99.94
description:
Jan 27 15:37:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.99.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Jan 27 15:37:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.219.110.215
description:
Jan 27 15:37:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.219.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Jan 27 15:37:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
description:
Jan 27 15:37:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
description:
2025-01-27 15:37:24 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:37395: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.214
description:
2025-01-27 15:38:54 dovecot_login authenticator failed for ([195.178.110.214]) [195.178.110.214]:50546: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Jan 27 15:38:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-01-27 15:38:20 dovecot_login authenticator failed for ([60.223.252.57]) [60.223.252.57]:33686: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.36.234.156
description:
Jan 27 15:38:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.36.234.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/js/data1/images/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 27 15:38:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.60.146
description:
Jan 27 15:38:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-01-27 15:38:03 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:35926: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.36.234.156
description:
2025-01-27 15:38:58 dovecot_login authenticator failed for ([118.36.234.156]) [118.36.234.156]:55266: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-27 15:38:04 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:57186: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.214
description:
Jan 27 15:38:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.82
description:
2025-01-27 15:39:13 dovecot_login authenticator failed for ([183.249.1.82]) [183.249.1.82]:35359: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/js/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.234.165.73
description:
Jan 27 15:39:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.234.165.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.82
description:
Jan 27 15:39:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/js/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.182.32.16
description:
Jan 27 15:40:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.182.32.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.182.32.16
description:
2025-01-27 15:40:17 dovecot_plain authenticator failed for ([118.182.32.16]) [118.182.32.16]:57018: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-01-27 15:40:01 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:35640: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 15:40:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 27 15:40:43 ait sshd[3026086]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 27 15:40:43 ait sshd[3026086]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/css/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.106.73
description:
2025-01-27 15:41:31 dovecot_plain authenticator failed for (Bundle-Ether3.2581.static.gvt.net.br) [177.43.106.73]:35029: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Jan 27 15:41:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
description:
Jan 27 15:41:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
description:
2025-01-27 15:41:58 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:57092: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.143
description:
Jan 27 15:41:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
description:
Jan 27 15:41:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 4.35.66.243
description:
2025-01-27 15:41:11 dovecot_plain authenticator failed for ([4.35.66.243]) [4.35.66.243]:32845: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 4.35.66.243
description:
Jan 27 15:41:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 4.35.66.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.151.131.211
description:
2025-01-27 15:41:38 dovecot_plain authenticator failed for 122-151-131-211.sta.wbroadband.net.au [122.151.131.211]:44216: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 27 15:41:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.139.7
description:
2025-01-27 15:41:56 dovecot_plain authenticator failed for ([122.160.139.7]) [122.160.139.7]:57346: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.143
description:
2025-01-27 15:41:02 dovecot_plain authenticator failed for ([122.187.227.143]) [122.187.227.143]:58032: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.151.131.211
description:
Jan 27 15:41:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.151.131.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-27 15:41:42 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:46176: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.139.7
description:
Jan 27 15:41:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.139.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 15:41:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
description:
2025-01-27 15:41:51 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:49859: 535 Incorrect authentication data (set_id=amihere-ackah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.43.106.73
description:
Jan 27 15:41:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.43.106.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.94.174.231
description:
Jan 27 15:41:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.94.174.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.94.174.231
description:
2025-01-27 15:41:14 dovecot_plain authenticator failed for ([109.94.174.231]) [109.94.174.231]:40458: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-01-27 15:41:39 dovecot_plain authenticator failed for ([50.223.176.171]) [50.223.176.171]:33389: 535 Incorrect authentication data (set_id=amihere-ackah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 15:41:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/images/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.172.79.198
description:
Jan 27 15:42:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.172.79.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.67.14
description:
Jan 27 15:42:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.67.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.67.14
description:
2025-01-27 15:42:51 dovecot_plain authenticator failed for ([170.250.67.14]) [170.250.67.14]:59091: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 27 15:42:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Jan 27 15:42:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
description:
2025-01-27 15:42:43 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:59896: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-27 15:42:03 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:44988: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
description:
Jan 27 15:42:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.197.164
description:
[2025-01-27 15:42:35 +0100] info [webmaild] 160.238.197.164 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
description:
2025-01-27 15:42:33 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:59970: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-27 15:42:56 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:46464: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.75.233
description:
Jan 27 15:43:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.75.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 27 15:42:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-01-27 15:42:03 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:44904: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
description:
Jan 27 15:42:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
description:
2025-01-27 15:42:07 dovecot_plain authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:38202: 535 Incorrect authentication data (set_id=abs1)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.197.15.243
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:15-43.104.197.15.243


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 15:43:43 ait sshd[3027541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.176.57
description:
2025-01-27 15:43:48 dovecot_plain authenticator failed for ([39.152.176.57]) [39.152.176.57]:38926: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-01-27 15:43:36 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:53290: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Jan 27 15:43:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.176.57
description:
Jan 27 15:43:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.176.57 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/css/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.86.144
description:
Jan 27 15:44:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.86.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.75.233
description:
2025-01-27 15:43:02 dovecot_plain authenticator failed for 42-200-75-233.static.imsbiz.com [42.200.75.233]:45601: 535 Incorrect authentication data (set_id=ebentil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/css/engine1/images/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Jan 27 15:44:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
description:
2025-01-27 15:44:16 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:46559: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.32.35.130
description:
[2025-01-27 15:44:30 +0100] info [webmaild] 102.32.35.130 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Jan 27 15:44:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
description:
Jan 27 15:44:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-01-27 15:44:18 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:42816: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Jan 27 15:44:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-01-27 15:44:26 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:12892: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-01-27 15:44:51 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:59363: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
description:
2025-01-27 15:44:02 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:37258: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.50.14
description:
Jan 27 15:45:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.50.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.50.14
description:
2025-01-27 15:45:57 dovecot_plain authenticator failed for (ip-177-25-34-169.user.vivozap.com.br) [187.92.50.14]:35764: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.9.146
description:
Jan 27 15:45:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.9.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.9.146
description:
2025-01-27 15:45:07 dovecot_plain authenticator failed for ([180.166.163.26]) [58.246.9.146]:34954: 535 Incorrect authentication data (set_id=abs2)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/images/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.234.245.7
description:
Jan 27 15:46:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.234.245.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.3
description:
Jan 27 15:46:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Jan 27 15:46:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/js/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-01-27 15:46:21 dovecot_login authenticator failed for ([49.65.1.179]) [49.65.1.179]:13117: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 27 15:46:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-01-27 15:46:48 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:38986: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 62.122.202.3
description:
[2025-01-27 15:46:10 +0100] info [webmaild] 62.122.202.3 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-01-27 15:46:26 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:35463: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.234.245.7
description:
2025-01-27 15:46:06 dovecot_plain authenticator failed for (net245.234.188-7.ertelecom.ru) [188.234.245.7]:54594: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Jan 27 15:46:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-01-27 15:46:29 dovecot_login authenticator failed for ([194.31.8.12]) [194.31.8.12]:60496: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-27 15:46:36 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:36854: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Jan 27 15:46:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/css/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-27 15:47:04 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:41093: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 15:47:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.75.225.206
description:
Jan 27 15:47:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.75.225.206 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.23.248.168
description:
[2025-01-27 15:47:02 +0100] info [webmaild] 31.23.248.168 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.118.123.44
description:
Jan 27 15:47:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.118.123.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.118.123.44
description:
2025-01-27 15:47:51 dovecot_plain authenticator failed for syn-172-118-123-044.res.spectrum.com [172.118.123.44]:48977: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 27 15:47:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
description:
Jan 27 15:47:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
description:
2025-01-27 15:47:55 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:35159: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.225.206
description:
2025-01-27 15:47:43 dovecot_plain authenticator failed for ([222.75.225.206]) [222.75.225.206]:47063: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Jan 27 15:48:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.100.164.121
description:
2025-01-27 15:48:36 dovecot_plain authenticator failed for ([183.100.164.121]) [183.100.164.121]:48252: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.199.118.234
description:
2025-01-27 15:48:46 dovecot_plain authenticator failed for (448990.cloudwaysapps.com) [128.199.118.234]:41174: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.193.137.250
description:
Jan 27 15:48:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.193.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.100.164.121
description:
Jan 27 15:48:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.100.164.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.199.118.234
description:
Jan 27 15:48:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.199.118.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Jan 27 15:48:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 15:48:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.167.167
description:
2025-01-27 15:48:11 dovecot_plain authenticator failed for (abts-north-static-167.167.160.122.airtelbroadband.in) [122.160.167.167]:35054: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-01-27 15:48:22 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:46388: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-01-27 15:48:47 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:39714: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.137.250
description:
2025-01-27 15:49:00 dovecot_plain authenticator failed for ([203.193.137.250]) [203.193.137.250]:51128: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.167.167
description:
Jan 27 15:48:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.167.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.22.47
description:
[2025-01-27 15:48:37 +0100] info [webmaild] 138.185.22.47 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/js/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
description:
2025-01-27 15:49:10 dovecot_login authenticator failed for ([116.231.84.13]) [116.231.84.13]:38176: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-01-27 15:49:11 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:34962: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-27 15:49:19 dovecot_plain authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:35746: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-27 15:49:44 dovecot_login authenticator failed for ([211.223.41.90]) [211.223.41.90]:39834: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.196.19.247
description:
[2025-01-27 15:49:07 +0100] info [webmaild] 131.196.19.247 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
description:
Jan 27 15:49:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 27 15:49:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/data1/images/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.88.91
description:
[2025-01-27 15:49:08 +0100] info [webmaild] 131.221.88.91 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 52.159.118.201
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:15-49.52.159.118.201


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Jan 27 15:49:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 27 15:50:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 27 15:49:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-27 15:49:10 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-176.static.tpgi.com.au) [110.175.220.250]:52767: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.166.167.139
description:
Jan 27 15:49:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.166.167.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
description:
2025-01-27 15:49:47 dovecot_plain authenticator failed for p5df1e80e.dip0.t-ipconnect.de [93.241.232.14]:39491: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-01-27 15:49:38 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:9596: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.241.232.14
description:
Jan 27 15:49:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.241.232.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Jan 27 15:49:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 27 15:49:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.166.167.139
description:
2025-01-27 15:49:20 dovecot_login authenticator failed for (abts-kk-static-139.167.166.122.airtelbroadband.in) [122.166.167.139]:52966: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.38.42.6
description:
[2025-01-27 15:50:35 +0100] info [webmaild] 189.38.42.6 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Jan 27 15:50:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/css/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-27 15:50:02 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:61248: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 27 15:50:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-27 15:50:12 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:31598: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Jan 27 15:50:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-01-27 15:50:21 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:41889: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-01-27 15:51:00 dovecot_login authenticator failed for ([118.45.101.159]) [118.45.101.159]:60621: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.189
description:
Jan 27 15:51:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.15.222.74
description:
Jan 27 15:51:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.15.222.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.15.222.74
description:
2025-01-27 15:51:08 dovecot_plain authenticator failed for ([218.15.222.74]) [218.15.222.74]:40869: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/engine1/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.214.168.101
description:
Jan 27 15:51:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.214.168.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.214.168.101
description:
2025-01-27 15:51:29 dovecot_plain authenticator failed for d-24-214-168-101.oh.cpe.breezeline.net [24.214.168.101]:43367: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Jan 27 15:51:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.91.165
description:
Jan 27 15:51:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.91.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Jan 27 15:51:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-01-27 15:51:37 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:60452: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.189
description:
2025-01-27 15:51:55 dovecot_plain authenticator failed for 189.46.246.220.static.netvigator.com [220.246.46.189]:64302: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.191.131
description:
2025-01-27 15:51:59 dovecot_plain authenticator failed for broadband-178-140-191-131.ip.moscow.rt.ru [178.140.191.131]:42875: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.91.165
description:
2025-01-27 15:51:16 dovecot_login authenticator failed for ([65.76.91.165]) [65.76.91.165]:60118: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-01-27 15:51:28 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:53226: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.191.131
description:
Jan 27 15:51:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.191.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-01-27 15:52:11 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:39600: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-27 15:52:51 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:32916: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.228.150
description:
2025-01-27 15:52:57 dovecot_plain authenticator failed for ([222.170.228.150]) [222.170.228.150]:58662: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
description:
2025-01-27 15:52:06 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:43986: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 114.130.70.45
description:
[2025-01-27 15:52:21 +0100] info [webmaild] 114.130.70.45 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
description:
Jan 27 15:52:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 27 15:52:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.228.150
description:
Jan 27 15:52:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.228.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/css/engine1/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 27 15:53:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-27 15:53:04 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:58941: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.160.194.108
description:
2025-01-27 15:53:08 dovecot_plain authenticator failed for ([61.2.64.128]) [103.160.194.108]:3891: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 147.236.230.129
description:
[2025-01-27 15:53:54 +0100] info [webmaild] 147.236.230.129 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.160.194.108
description:
Jan 27 15:53:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.160.194.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Jan 27 15:54:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-01-27 15:54:48 dovecot_plain authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:51090: 535 Incorrect authentication data (set_id=edonkor)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/engine1/data1/images/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/engine1


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.205.18.249
description:
[2025-01-27 15:54:16 +0100] info [webmaild] 186.205.18.249 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 27 15:54:18 ait sshd[3034124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Jan 27 15:54:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Jan 27 15:54:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
description:
2025-01-27 15:54:17 dovecot_plain authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:59000: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 15:54:18 ait sshd[3034124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-01-27 15:54:43 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:46444: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Jan 27 15:54:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.145.168.9
description:
2025-01-27 15:54:28 dovecot_plain authenticator failed for ([219.145.168.9]) [219.145.168.9]:49736: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.145.168.9
description:
Jan 27 15:54:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.145.168.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-01-27 15:54:32 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:55713: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 27 15:54:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-27 15:54:39 dovecot_plain authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:43237: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.133.16
description:
[2025-01-27 15:55:53 +0100] info [webmaild] 170.254.133.16 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-27 15:55:22 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:37482: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-01-27 15:55:33 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:37848: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
description:
2025-01-27 15:55:43 dovecot_plain authenticator failed for ([103.59.134.177]) [103.59.134.177]:6893: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.115.227
description:
2025-01-27 15:55:51 dovecot_plain authenticator failed for ([165.90.115.227]) [165.90.115.227]:35061: 535 Incorrect authentication data (set_id=sng26b99239y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/js/images/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 27 15:55:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
description:
Jan 27 15:55:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.115.227
description:
Jan 27 15:55:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.115.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Jan 27 15:56:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
description:
Jan 27 15:56:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-27 15:56:23 dovecot_plain authenticator failed for ([114.242.61.35]) [114.242.61.35]:58220: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.129.180
description:
2025-01-27 15:56:47 dovecot_plain authenticator failed for ([178.70.129.180]) [178.70.129.180]:55398: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-01-27 15:56:12 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:37380: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.153.203.140
description:
[2025-01-27 15:56:21 +0100] info [webmaild] 178.153.203.140 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
description:
2025-01-27 15:56:21 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:53768: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Jan 27 15:56:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 27 15:56:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.129.180
description:
Jan 27 15:56:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.129.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-01-27 15:56:12 dovecot_plain authenticator failed for ([201.98.208.115]) [201.98.208.115]:35472: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.209.199
description:
Jan 27 15:56:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.209.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.209.199
description:
2025-01-27 15:56:57 dovecot_plain authenticator failed for ([177.44.209.199]) [177.44.209.199]:53954: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.170.50.2
description:
2025-01-27 15:57:21 dovecot_plain authenticator failed for ([45.170.50.2]) [45.170.50.2]:33471: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-01-27 15:57:12 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:56577: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
description:
2025-01-27 15:57:25 dovecot_plain authenticator failed for 119-46-148-53.static.asianet.co.th [119.46.148.53]:56615: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.237.213.248
description:
Jan 27 15:57:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.237.213.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.104.180
description:
2025-01-27 15:57:37 dovecot_plain authenticator failed for ([218.94.104.181]) [218.94.104.180]:37755: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.186.134.35
description:
2025-01-27 15:57:51 dovecot_plain authenticator failed for (hamiaccrea) [78.186.134.35]:52973: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-01-27 15:57:05 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:53565: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.178
description:
2025-01-27 15:57:10 dovecot_plain authenticator failed for ([197.250.7.67]) [41.220.129.178]:54682: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.237.213.248
description:
2025-01-27 15:57:39 dovecot_plain authenticator failed for ([183.237.213.248]) [183.237.213.248]:55955: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Jan 27 15:57:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.104.180
description:
Jan 27 15:57:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.104.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.134.35
description:
Jan 27 15:57:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.134.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.230.168.26
description:
Jan 27 15:57:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.230.168.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
description:
2025-01-27 15:57:57 dovecot_plain authenticator failed for 90-230-168-26-no600.tbcn.telia.com [90.230.168.26]:56468: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.234.165.73
description:
2025-01-27 15:58:20 dovecot_plain authenticator failed for ([58.234.165.73]) [58.234.165.73]:38668: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.126.212.30
description:
Jan 27 15:58:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.126.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Jan 27 15:58:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-01-27 15:58:39 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:42141: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.145.108.234
description:
2025-01-27 15:58:52 dovecot_plain authenticator failed for ([216.145.108.234]) [216.145.108.234]:39859: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.156.63.212
description:
Jan 27 15:58:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.156.63.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.213
description:
Jan 27 15:58:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.234.165.73
description:
Jan 27 15:58:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.234.165.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.205.242
description:
2025-01-27 15:58:21 dovecot_plain authenticator failed for ([218.4.205.242]) [218.4.205.242]:45341: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 15:58:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.156.63.212
description:
2025-01-27 15:58:17 dovecot_plain authenticator failed for ([202.156.63.212]) [202.156.63.212]:53096: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.167.25
description:
Jan 27 15:58:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.167.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.128.5
description:
2025-01-27 15:58:48 dovecot_plain authenticator failed for ([170.250.128.5]) [170.250.128.5]:38500: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.35
description:
2025-01-27 15:58:51 dovecot_plain authenticator failed for (m121-202-152-35.smartone.com) [121.202.152.35]:52261: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 15:58:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-27 15:58:33 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:44367: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
description:
2025-01-27 15:58:33 dovecot_plain authenticator failed for ([60.14.36.47]) [60.14.36.47]:58808: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.44.204
description:
2025-01-27 15:58:04 dovecot_plain authenticator failed for p384205-obmd01.tokyo.ocn.ne.jp [60.45.44.204]:34929: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 27 15:58:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Jan 27 15:58:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.126.212.30
description:
2025-01-27 15:58:38 dovecot_plain authenticator failed for ([129.126.212.30]) [129.126.212.30]:58541: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.45.44.204
description:
Jan 27 15:58:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.45.44.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.167.25
description:
2025-01-27 15:58:27 dovecot_plain authenticator failed for ([187.95.167.25]) [187.95.167.25]:62408: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-01-27 15:58:36 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:43152: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.145.108.234
description:
Jan 27 15:58:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.145.108.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.205.242
description:
Jan 27 15:58:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.205.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.14.36.47
description:
Jan 27 15:58:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.14.36.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.35
description:
Jan 27 15:58:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.213
description:
2025-01-27 15:58:19 dovecot_plain authenticator failed for (m121-202-154-213.smartone.com) [121.202.154.213]:26205: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.128.5
description:
Jan 27 15:58:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.128.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.193
description:
Jan 27 15:59:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.239.202
description:
2025-01-27 15:59:03 dovecot_plain authenticator failed for ([117.247.239.202]) [117.247.239.202]:38896: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 15:59:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.193
description:
2025-01-27 15:59:58 dovecot_plain authenticator failed for (nsg-corporate-193.227.187.122.airtel.in) [122.187.227.193]:34293: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.247.239.202
description:
Jan 27 15:59:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.247.239.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/engine1/data1/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/css/images/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 27 16:00:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.234.208
description:
Jan 27 16:00:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.234.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
description:
2025-01-27 16:00:21 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:51392: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 27 16:00:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 16:00:39 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:49014: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-27 16:00:47 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:32640: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.136.42.222
description:
Jan 27 16:00:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.136.42.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
description:
2025-01-27 16:00:16 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:45598: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.29
description:
Jan 27 16:00:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.29
description:
2025-01-27 16:00:25 dovecot_login authenticator failed for ([117.175.160.29]) [117.175.160.29]:45516: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.126.212.30
description:
2025-01-27 16:00:31 dovecot_plain authenticator failed for ([129.126.212.30]) [129.126.212.30]:33307: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Jan 27 16:00:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.126.212.30
description:
Jan 27 16:00:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.126.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.148
description:
Jan 27 16:00:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.131
description:
Jan 27 16:00:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.148
description:
2025-01-27 16:00:33 dovecot_login authenticator failed for ([104.241.229.148]) [104.241.229.148]:33347: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.131
description:
2025-01-27 16:00:35 dovecot_login authenticator failed for ([178.178.194.131]) [178.178.194.131]:60278: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-01-27 16:00:20 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:37864: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-27 16:00:07 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:45372: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-27 16:00:26 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:43993: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 16:00:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Jan 27 16:00:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.234.208
description:
2025-01-27 16:00:09 dovecot_plain authenticator failed for (deenetservices.net) [103.89.234.208]:49710: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Jan 27 16:00:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Jan 27 16:00:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-01-27 16:00:48 dovecot_login authenticator failed for net-130-0-149-238.cust.vodafonedsl.it [130.0.149.238]:60700: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.71.8
description:
Jan 27 16:01:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.71.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.198.101.47
description:
2025-01-27 16:01:02 dovecot_plain authenticator failed for ([195.198.101.47]) [195.198.101.47]:51018: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/engine1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.6.78.182
description:
Jan 27 16:01:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.6.78.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.187
description:
Jan 27 16:01:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-27 16:01:32 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:34552: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.6.78.182
description:
2025-01-27 16:01:18 dovecot_login authenticator failed for (bd064eb6.virtua.com.br) [189.6.78.182]:40308: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
description:
Jan 27 16:01:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
description:
2025-01-27 16:01:39 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:34002: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.198.101.47
description:
Jan 27 16:01:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.198.101.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.20.15.167
description:
2025-01-27 16:01:19 dovecot_plain authenticator failed for ([60.20.15.167]) [60.20.15.167]:50073: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.174.44.25
description:
[2025-01-27 16:01:36 +0100] info [webmaild] 103.174.44.25 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.96.137.80
description:
[2025-01-27 16:01:38 +0100] info [webmaild] 179.96.137.80 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.71.8
description:
2025-01-27 16:01:48 dovecot_plain authenticator failed for 37.151.71.8.dynamic.telecom.kz [37.151.71.8]:34918: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.20.15.167
description:
Jan 27 16:01:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.20.15.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
description:
2025-01-27 16:02:07 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:58714: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
description:
2025-01-27 16:02:53 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:41838: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-27 16:02:54 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38712: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.189
description:
2025-01-27 16:02:58 dovecot_plain authenticator failed for 189.46.246.220.static.netvigator.com [220.246.46.189]:63223: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.247
description:
2025-01-27 16:02:23 dovecot_plain authenticator failed for (m121-202-153-247.smartone.com) [121.202.153.247]:6937: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.62.171
description:
2025-01-27 16:02:32 dovecot_plain authenticator failed for ([103.147.62.171]) [103.147.62.171]:49006: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Jan 27 16:02:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-27 16:02:05 dovecot_login authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:59974: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.128.108
description:
2025-01-27 16:02:07 dovecot_plain authenticator failed for ([39.129.128.108]) [39.129.128.108]:57526: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Jan 27 16:02:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.218.28.118
description:
Jan 27 16:02:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.218.28.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.218.28.118
description:
2025-01-27 16:02:18 dovecot_login authenticator failed for (cpe-c83a353b2048.cpe.cableonda.net) [190.218.28.118]:55798: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 16:02:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/engine1/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.0.112
description:
Jan 27 16:02:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 27 16:02:58 ait sshd[3040141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.104.147.6
description:
Jan 27 16:02:23 ait sshd[3039520]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.104.147.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.62.171
description:
Jan 27 16:02:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.62.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-01-27 16:02:56 dovecot_plain authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:56882: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.155
description:
Jan 27 16:02:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.0.112
description:
2025-01-27 16:02:45 dovecot_plain authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:33386: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
description:
Jan 27 16:02:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 27 16:02:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Jan 27 16:02:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 27 16:02:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.128.108
description:
Jan 27 16:02:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.128.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.247
description:
Jan 27 16:02:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.155
description:
2025-01-27 16:02:30 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:44212: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 27 16:02:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-27 16:02:04 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:48640: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
description:
Jan 27 16:02:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-01-27 16:02:17 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:39640: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.104.147.6
description:
Jan 27 16:02:23 ait sshd[3039520]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.104.147.6


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-27 16:02:48 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:34566: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.189
description:
Jan 27 16:02:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 27 16:02:58 ait sshd[3040141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.168.194
description:
Jan 27 16:03:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.168.194 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/images/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 27 16:03:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.38.211.242
description:
2025-01-27 16:03:13 dovecot_plain authenticator failed for p383243-obmd01.tokyo.ocn.ne.jp [60.38.211.242]:44624: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.77.137.236
description:
Jan 27 16:03:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.77.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-27 16:03:22 dovecot_plain authenticator failed for ([59.98.150.190]) [122.160.68.46]:43356: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Jan 27 16:03:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.231.163.154
description:
2025-01-27 16:03:08 dovecot_plain authenticator failed for ([103.231.163.154]) [103.231.163.154]:63381: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.77.137.236
description:
2025-01-27 16:03:17 dovecot_plain authenticator failed for ([110.77.137.236]) [110.77.137.236]:33332: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Jan 27 16:03:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 27 16:03:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.50.39
description:
2025-01-27 16:03:32 dovecot_plain authenticator failed for ([120.194.50.39]) [120.194.50.39]:12872: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.248.205.14
description:
2025-01-27 16:03:53 dovecot_plain authenticator failed for ([220.248.205.15]) [220.248.205.14]:1330: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.231.163.154
description:
Jan 27 16:03:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.231.163.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-27 16:03:12 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:57320: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.10.114
description:
2025-01-27 16:03:17 dovecot_plain authenticator failed for vps-0b1302de.vps.ovh.net [51.91.10.114]:41858: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.168.194
description:
2025-01-27 16:03:31 dovecot_plain authenticator failed for ([65.76.168.194]) [65.76.168.194]:52062: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.95.8
description:
2025-01-27 16:03:38 dovecot_plain authenticator failed for ([50.231.95.8]) [50.231.95.8]:46367: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.91.10.114
description:
Jan 27 16:03:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.91.10.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-01-27 16:03:23 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:52964: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.50.39
description:
Jan 27 16:03:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.50.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.231.95.8
description:
Jan 27 16:03:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.231.95.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.248.205.14
description:
Jan 27 16:03:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.248.205.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.156.198
description:
2025-01-27 16:03:06 dovecot_login authenticator failed for ([116.116.156.198]) [116.116.156.198]:51443: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/images/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.67.38.27
description:
Jan 27 16:04:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.67.38.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-27 16:04:50 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:44540: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.138.119.75
description:
Jan 27 16:04:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.138.119.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 27 16:04:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 27 16:04:54 ait sshd[3041125]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 16:04:54 ait sshd[3041125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-27 16:05:00 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38682: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.38.27
description:
2025-01-27 16:04:17 dovecot_plain authenticator failed for 89-67-38-27.dynamic.chello.pl [89.67.38.27]:57996: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 27 16:04:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-27 16:04:51 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:42180: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 27 16:04:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.138.119.75
description:
2025-01-27 16:04:57 dovecot_plain authenticator failed for (75-119-138-120.mysipl.com) [120.138.119.75]:44588: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.78
description:
Jan 27 16:05:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 27 16:05:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.189
description:
Jan 27 16:05:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.78
description:
2025-01-27 16:05:11 dovecot_login authenticator failed for ([111.61.176.78]) [111.61.176.78]:16714: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-01-27 16:05:45 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:33986: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/css/engine1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.29.101
description:
2025-01-27 16:05:10 dovecot_login authenticator failed for (doserver.womenpla.net) [139.59.29.101]:51682: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-27 16:05:22 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:42668: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.135.74
description:
2025-01-27 16:05:42 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:42790: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-27 16:05:58 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:60331: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.133
description:
2025-01-27 16:06:00 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:32776: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Jan 27 16:05:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.61.248
description:
2025-01-27 16:05:25 dovecot_plain authenticator failed for ([14.99.61.248]) [14.99.61.248]:36892: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 27 16:05:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.31.12.187
description:
2025-01-27 16:05:28 dovecot_login authenticator failed for (static.vnpt.vn) [123.31.12.187]:38968: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.99.61.248
description:
Jan 27 16:05:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.99.61.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.31.12.187
description:
Jan 27 16:05:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.31.12.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Jan 27 16:05:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-27 16:05:48 dovecot_login authenticator failed for ([103.109.44.163]) [103.109.44.163]:47278: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.133
description:
Jan 27 16:05:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-01-27 16:05:08 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:40660: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 27 16:05:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-27 16:05:31 dovecot_login authenticator failed for ([59.98.150.190]) [122.160.68.46]:58046: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 27 16:05:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 27 16:05:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.29.101
description:
Jan 27 16:05:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.29.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 16:05:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Jan 27 16:05:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-27 16:05:41 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:43035: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.172.225.52
description:
Jan 27 16:06:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.172.225.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.122.31.214
description:
Jan 27 16:06:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.122.31.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.172.225.52
description:
2025-01-27 16:06:09 dovecot_plain authenticator failed for ([178.172.225.52]) [178.172.225.52]:57669: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.122.31.214
description:
2025-01-27 16:06:12 dovecot_login authenticator failed for ([91.122.31.214]) [91.122.31.214]:32940: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 27 16:06:56 ait sshd[3042641]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.189
description:
2025-01-27 16:06:01 dovecot_plain authenticator failed for 189.46.246.220.static.netvigator.com [220.246.46.189]:50841: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 27 16:06:56 ait sshd[3042641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.104.147.6
description:
Jan 27 16:07:40 ait sshd[3043071]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.104.147.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 27 16:07:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-27 16:07:07 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:60608: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.189.232
description:
Jan 27 16:07:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.189.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.189.232
description:
2025-01-27 16:07:21 dovecot_plain authenticator failed for (host-232.185.15.189.0.0xffffff00.STERLING.stercom.ru) [185.15.189.232]:42410: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.226.114
description:
2025-01-27 16:07:38 H=(mail.jabmar.org) [165.154.226.114]:64430 F=<rirfvlhpc@jabmar.org> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.104.147.6
description:
Jan 27 16:07:40 ait sshd[3043071]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.104.147.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 27 16:08:55 ait sshd[3043753]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 82.211.2.126
description:
[2025-01-27 16:08:22 +0100] info [cpaneld] 82.211.2.126 - wwuni002 "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: User wwuni002 has their account suspended. Login blocked.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 27 16:08:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 27 16:08:55 ait sshd[3043753]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-27 16:08:35 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:61207: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/js/js/css/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.104.147.6
description:
Jan 27 16:09:27 ait sshd[3044067]: pam_imunify(sshd:auth): [IM360_RBL] The IP 36.104.147.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 36.104.147.6
description:
Jan 27 16:09:27 ait sshd[3044067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=36.104.147.6


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 36.104.147.6
description:
Jan 27 16:09:29 ait sshd[3044067]: Failed password for invalid user shankar from 36.104.147.6 port 42090 ssh2


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 27 16:11:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.4.98
description:
Jan 27 16:10:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.4.98
description:
2025-01-27 16:10:35 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:47250: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.19.176
description:
Jan 27 16:10:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.19.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 27 16:10:52 ait sshd[3045173]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.245
description:
2025-01-27 16:10:42 dovecot_login authenticator failed for ([104.241.234.245]) [104.241.234.245]:55217: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
description:
2025-01-27 16:10:46 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:41018: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.22.229.211
description:
[2025-01-27 16:10:30 +0100] info [webmaild] 46.22.229.211 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.245
description:
Jan 27 16:10:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 27 16:10:52 ait sshd[3045173]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.77.216.166
description:
2025-01-27 16:11:03 dovecot_plain authenticator failed for 79-77-216-166.dynamic.dsl.as9105.com [79.77.216.166]:51317: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.53.82
description:
2025-01-27 16:11:15 dovecot_plain authenticator failed for ([60.172.53.82]) [60.172.53.82]:45742: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.52
description:
2025-01-27 16:11:27 dovecot_plain authenticator failed for ([60.31.181.52]) [60.31.181.52]:45033: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.52
description:
Jan 27 16:11:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.242.165.148
description:
2025-01-27 16:11:26 dovecot_plain authenticator failed for ([1.242.165.148]) [1.242.165.148]:50125: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/js/data1/images/engine1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-27 16:11:02 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:19189: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.53.82
description:
Jan 27 16:11:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.53.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.242.165.148
description:
Jan 27 16:11:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.242.165.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.77.216.166
description:
Jan 27 16:11:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.77.216.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.98.229
description:
[2025-01-27 16:11:49 +0100] info [webmaild] 170.239.98.229 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.26.178.196
description:
2025-01-27 16:12:06 dovecot_login authenticator failed for ([72.26.178.196]) [72.26.178.196]:52740: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-01-27 16:12:17 dovecot_login authenticator failed for (m121-202-197-86.smartone.com) [121.202.197.86]:44549: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Jan 27 16:12:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.251
description:
Jan 27 16:12:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.251 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/engine1/js/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Jan 27 16:12:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Jan 27 16:12:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.251
description:
2025-01-27 16:12:29 dovecot_login authenticator failed for ([104.241.238.251]) [104.241.238.251]:43793: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.72
description:
Jan 27 16:12:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.72
description:
2025-01-27 16:12:38 dovecot_plain authenticator failed for ([183.249.1.72]) [183.249.1.72]:39090: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-01-27 16:12:28 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:38734: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 16:12:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.89.199
description:
2025-01-27 16:12:53 dovecot_plain authenticator failed for ([223.171.89.199]) [223.171.89.199]:59202: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 27 16:13:00 ait sshd[3046711]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.89.199
description:
Jan 27 16:12:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.89.199 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 27 16:13:00 ait sshd[3046711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 27 16:14:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.116.98
description:
[2025-01-27 16:14:01 +0100] info [webmaild] 213.230.116.98 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
description:
2025-01-27 16:14:04 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:31168: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-27 16:14:17 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:38094: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.33.197
description:
Jan 27 16:14:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.33.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.224.33.197
description:
2025-01-27 16:14:37 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.33.197]:21179: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.29.47
description:
47.128.29.47 - - [27/Jan/2025:16:14:44 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28692363 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/174319?panel=config" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.29.47


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
description:
Jan 27 16:14:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.124.84
description:
2025-01-27 16:14:23 dovecot_login authenticator failed for ([219.157.124.84]) [219.157.124.84]:34300: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.226.215
description:
Jan 27 16:14:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.226.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-27 16:15:00 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:64395: 535 Incorrect authentication data (set_id=klah)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/engine1/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 27 16:14:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.124.84
description:
Jan 27 16:14:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.124.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.42.226.215
description:
2025-01-27 16:14:45 dovecot_plain authenticator failed for ([58.42.226.215]) [58.42.226.215]:53995: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.82.254.104
description:
[2025-01-27 16:14:36 +0100] info [webmaild] 103.82.254.104 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.32.71.177
description:
[2025-01-27 16:14:38 +0100] info [webmaild] 193.32.71.177 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.34
description:
2025-01-27 16:15:26 dovecot_plain authenticator failed for (nsg-corporate-34.230.187.122.airtel.in) [122.187.230.34]:55521: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 27 16:15:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-27 16:15:42 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:35938: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.229.145.140
description:
[2025-01-27 16:15:55 +0100] info [webmaild] 45.229.145.140 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-27 16:15:55 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:59494: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 27 16:15:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/data1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 27 16:15:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.34
description:
Jan 27 16:15:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-27 16:15:25 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:32891: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Jan 27 16:15:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-01-27 16:15:52 dovecot_plain authenticator failed for ([116.114.97.10]) [116.114.97.10]:43468: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.244.68.3
description:
2025-01-27 16:16:32 dovecot_login authenticator failed for ([109.244.68.3]) [109.244.68.3]:50319: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-27 16:16:59 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:52029: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Jan 27 16:16:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.244.68.3
description:
Jan 27 16:16:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.244.68.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 27 16:16:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-01-27 16:16:34 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:34005: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.10.94
description:
Jan 27 16:16:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.10.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-01-27 16:16:25 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:36660: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-27 16:16:27 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:47672: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.76.88.16
description:
[2025-01-27 16:16:50 +0100] info [webmaild] 189.76.88.16 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Jan 27 16:16:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.137
description:
2025-01-27 16:16:13 dovecot_plain authenticator failed for ([178.178.194.137]) [178.178.194.137]:49934: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.59.141.152
description:
2025-01-27 16:16:23 dovecot_plain authenticator failed for ([5.59.141.152]) [5.59.141.152]:49626: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.59.141.152
description:
Jan 27 16:16:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.59.141.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Jan 27 16:16:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 27 16:16:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/css/css/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 27 16:16:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-27 16:16:54 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:59464: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 27 16:16:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-27 16:16:06 dovecot_plain authenticator failed for ([58.18.81.242]) [58.18.81.242]:46706: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.137
description:
Jan 27 16:16:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-01-27 16:16:13 dovecot_login authenticator failed for ([89.175.253.49]) [89.175.253.49]:53314: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 27 16:16:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 16:16:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-27 16:16:38 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:58160: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.10.94
description:
2025-01-27 16:16:39 dovecot_login authenticator failed for ([223.71.10.94]) [223.71.10.94]:58385: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.70
description:
2025-01-27 16:17:35 dovecot_login authenticator failed for ([104.241.238.70]) [104.241.238.70]:50090: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.84.241.94
description:
2025-01-27 16:17:15 dovecot_login authenticator failed for ([119.84.241.94]) [119.84.241.94]:42470: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.141
description:
Jan 27 16:17:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 27 16:17:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.29.76.99
description:
2025-01-27 16:17:36 dovecot_login authenticator failed for ([14.29.76.100]) [14.29.76.99]:58391: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 27 16:17:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-27 16:17:52 dovecot_login authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:33730: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
description:
2025-01-27 16:17:20 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:46652: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
description:
2025-01-27 16:17:39 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:61779: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.41.103
description:
2025-01-27 16:17:55 dovecot_plain authenticator failed for ([60.172.41.103]) [60.172.41.103]:50390: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 27 16:18:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 16:17:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 16:17:04 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:46235: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
description:
Jan 27 16:17:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
description:
Jan 27 16:17:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.125
description:
Jan 27 16:17:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 16:17:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.84.241.94
description:
Jan 27 16:17:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.84.241.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.125
description:
2025-01-27 16:17:50 dovecot_plain authenticator failed for ([80.233.77.125]) [80.233.77.125]:23203: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-27 16:17:14 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:55930: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 27 16:17:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-27 16:17:23 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:50332: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.141
description:
2025-01-27 16:17:23 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:43820: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.29.76.99
description:
Jan 27 16:17:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.29.76.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-27 16:17:33 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:36729: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 27 16:17:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-27 16:17:47 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:59242: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.41.103
description:
Jan 27 16:17:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.41.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 16:17:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 27 16:17:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 16:18:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-27 16:18:15 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:64085: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-01-27 16:18:35 dovecot_plain authenticator failed for ([78.134.19.99]) [78.134.19.99]:56964: 535 Incorrect authentication data (set_id=ads21a00010y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
description:
2025-01-27 16:18:36 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:53606: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 16:18:37 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:39330: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.29.20.52
description:
2025-01-27 16:18:47 dovecot_plain authenticator failed for host-92-29-20-52.as13285.net [92.29.20.52]:40463: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.30.214
description:
Jan 27 16:18:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.30.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.187.61.70
description:
2025-01-27 16:18:56 dovecot_plain authenticator failed for (node-115-187-61-70.alliancebroadband.in) [115.187.61.70]:47248: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Jan 27 16:18:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Jan 27 16:18:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-27 16:18:26 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:37400: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.131.215.223
description:
[2025-01-27 16:18:31 +0100] info [webmaild] 94.131.215.223 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-27 16:18:05 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:47764: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.30.214
description:
2025-01-27 16:18:51 dovecot_plain authenticator failed for ([220.77.30.214]) [220.77.30.214]:49355: 535 Incorrect authentication data (set_id=ads21a00010y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-01-27 16:18:58 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:34164: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-27 16:18:45 dovecot_plain authenticator failed for ([89.211.42.163]) [37.186.40.110]:38758: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 27 16:18:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 27 16:18:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-27 16:18:05 dovecot_plain authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:31841: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
description:
Jan 27 16:18:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 27 16:18:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.29.20.52
description:
Jan 27 16:18:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.29.20.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.187.61.70
description:
Jan 27 16:18:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.187.61.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 27 16:18:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/data1/images/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 27 16:18:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-27 16:18:02 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:59472: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-27 16:19:27 dovecot_plain authenticator failed for ([2.57.219.6]) [2.57.219.2]:55314: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-27 16:19:53 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:41344: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.143
description:
Jan 27 16:19:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-27 16:19:40 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:34563: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 16:19:45 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:35288: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.223
description:
Jan 27 16:19:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
description:
Jan 27 16:19:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-01-27 16:19:55 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:60929: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.206.63.169
description:
Jan 27 16:19:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.206.63.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-27 16:19:22 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:39661: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.81
description:
2025-01-27 16:19:27 dovecot_plain authenticator failed for 210.0.90.81.static.nexnet.net.au [210.0.90.81]:32984: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 27 16:19:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
description:
Jan 27 16:19:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 27 16:19:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-27 16:19:52 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:35969: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.199.251
description:
2025-01-27 16:19:55 dovecot_plain authenticator failed for ([190.104.199.251]) [190.104.199.251]:34751: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.143
description:
2025-01-27 16:19:11 dovecot_plain authenticator failed for ([223.197.153.143]) [223.197.153.143]:63077: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 27 16:19:14 ait sshd[3050858]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 27 16:19:14 ait sshd[3050858]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/engine1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 27 16:19:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.99.36.130
description:
2025-01-27 16:19:41 dovecot_login authenticator failed for ([50.99.36.130]) [50.99.36.130]:35080: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.223
description:
2025-01-27 16:19:45 dovecot_login authenticator failed for ([93.182.160.223]) [93.182.160.223]:43578: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 27 16:19:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
description:
2025-01-27 16:19:52 dovecot_plain authenticator failed for ([222.186.68.153]) [222.186.68.153]:56253: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
description:
2025-01-27 16:19:06 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:57431: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Jan 27 16:19:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-01-27 16:19:17 dovecot_plain authenticator failed for ([168.167.55.230]) [168.167.55.230]:43413: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.206.63.169
description:
2025-01-27 16:19:25 dovecot_login authenticator failed for ([47.206.63.169]) [47.206.63.169]:41096: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 27 16:19:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.0.90.81
description:
Jan 27 16:19:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.0.90.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 27 16:19:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.104.199.251
description:
Jan 27 16:19:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.104.199.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 16:19:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
description:
Jan 27 16:19:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
description:
Jan 27 16:20:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.167.25
description:
Jan 27 16:20:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.167.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.74.36
description:
Jan 27 16:20:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-01-27 16:20:44 dovecot_plain authenticator failed for (netcomafrica.com) [41.67.143.142]:57238: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Jan 27 16:20:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.112.103.62
description:
Jan 27 16:20:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.112.103.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
description:
Jan 27 16:20:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
description:
2025-01-27 16:20:13 dovecot_plain authenticator failed for ([65.20.213.101]) [65.20.213.101]:42151: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 27 16:20:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.74.36
description:
2025-01-27 16:20:33 dovecot_login authenticator failed for ([164.92.74.36]) [164.92.74.36]:45428: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
description:
2025-01-27 16:20:35 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:55690: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
description:
Jan 27 16:20:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
description:
2025-01-27 16:20:02 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:37022: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-27 16:20:20 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:45102: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.245
description:
2025-01-27 16:20:39 dovecot_plain authenticator failed for (m121-202-152-245.smartone.com) [121.202.152.245]:27164: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.240.66
description:
2025-01-27 16:20:47 dovecot_login authenticator failed for ([220.124.240.66]) [220.124.240.66]:63786: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.112.103.62
description:
2025-01-27 16:20:55 dovecot_plain authenticator failed for p160063-obmd01.osaka.ocn.ne.jp [61.112.103.62]:53760: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.77.59.204
description:
[2025-01-27 16:20:21 +0100] info [webmaild] 105.77.59.204 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.75.46
description:
2025-01-27 16:20:32 dovecot_login authenticator failed for ([114.242.175.187]) [36.112.75.46]:12092: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.245
description:
Jan 27 16:20:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-01-27 16:20:48 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:48158: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
description:
2025-01-27 16:20:58 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:38912: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.167.25
description:
2025-01-27 16:20:16 dovecot_plain authenticator failed for ([187.95.167.25]) [187.95.167.25]:45627: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-27 16:20:31 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:44420: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 27 16:20:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
description:
Jan 27 16:20:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/css/engine1/engine1/data1/images/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.75.46
description:
Jan 27 16:20:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.75.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
description:
Jan 27 16:20:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 27 16:20:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
description:
Jan 27 16:21:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-01-27 16:21:42 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:41979: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
description:
2025-01-27 16:21:47 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:36108: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/engine1/images/data1/images/data1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.94.41.218
description:
Jan 27 16:21:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.94.41.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.233.8.104
description:
[2025-01-27 16:21:34 +0100] info [webmaild] 188.233.8.104 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.102.11
description:
Jan 27 16:21:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.102.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 16:21:06 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:53034: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Jan 27 16:21:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-01-27 16:21:30 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:56104: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.94.41.218
description:
2025-01-27 16:21:35 dovecot_plain authenticator failed for ([218.94.41.218]) [218.94.41.218]:56133: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Jan 27 16:21:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.126.214
description:
Jan 27 16:22:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.126.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.126.214
description:
2025-01-27 16:22:23 dovecot_plain authenticator failed for ([175.205.126.214]) [175.205.126.214]:40852: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.90.207.82
description:
2025-01-27 16:22:52 dovecot_plain authenticator failed for ([182.90.207.82]) [182.90.207.82]:43034: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.90.207.82
description:
Jan 27 16:22:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.90.207.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.75.104.218
description:
Jan 27 16:22:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.75.104.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.104.218
description:
2025-01-27 16:22:11 dovecot_plain authenticator failed for ([91.75.104.218]) [91.75.104.218]:53655: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/engine1/images/data1/images/js/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-27 16:22:39 dovecot_login authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:52964: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 27 16:22:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.168.6
description:
[2025-01-27 16:22:14 +0100] info [webmaild] 186.233.168.6 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.90.34.90
description:
2025-01-27 16:22:38 dovecot_plain authenticator failed for ([102.90.34.90]) [102.90.34.90]:47697: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-01-27 16:22:41 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:46130: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.90.34.90
description:
Jan 27 16:22:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.90.34.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 27 16:22:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Jan 27 16:22:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-27 16:22:49 dovecot_plain authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:62906: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
description:
Jan 27 16:23:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-27 16:23:22 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:34772: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.129.128.108
description:
Jan 27 16:23:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.129.128.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.206.139.50
description:
2025-01-27 16:23:24 dovecot_plain authenticator failed for ([218.206.139.50]) [218.206.139.50]:57002: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 27 16:23:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.242.149.240
description:
Jan 27 16:23:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.242.149.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.242.149.240
description:
2025-01-27 16:23:02 dovecot_login authenticator failed for c-69-242-149-240.hsd1.mo.comcast.net [69.242.149.240]:44128: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/engine1/images/data1/images/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.148.41
description:
Jan 27 16:23:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.148.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.148.41
description:
2025-01-27 16:23:08 dovecot_plain authenticator failed for 041.148.48.116.static.netvigator.com [116.48.148.41]:60445: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 27 16:23:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-27 16:23:16 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:32976: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 27 16:23:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.129.128.108
description:
2025-01-27 16:23:26 dovecot_plain authenticator failed for ([39.129.128.108]) [39.129.128.108]:48054: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-27 16:23:33 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:53770: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
description:
2025-01-27 16:23:37 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:37668: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.206.139.50
description:
Jan 27 16:23:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.206.139.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
description:
2025-01-27 16:23:31 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:40374: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
description:
Jan 27 16:23:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.87.198
description:
[2025-01-27 16:23:53 +0100] info [webmaild] 213.230.87.198 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.49.15
description:
Jan 27 16:24:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.213.49.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.134.31.193
description:
2025-01-27 16:24:20 dovecot_plain authenticator failed for ([121.134.31.193]) [121.134.31.193]:40797: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.49.14
description:
2025-01-27 16:24:42 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.49.14]:28260: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 27 16:24:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-27 16:24:52 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:60528: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
description:
2025-01-27 16:24:08 dovecot_plain authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:56754: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.62.78.104
description:
[2025-01-27 16:24:41 +0100] info [webmaild] 187.62.78.104 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.213.193.49
description:
2025-01-27 16:24:45 dovecot_login authenticator failed for ([103.213.193.49]) [103.213.193.49]:3808: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 27 16:24:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.49.14
description:
Jan 27 16:24:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.49.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.193.49
description:
Jan 27 16:24:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.193.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.134.31.193
description:
Jan 27 16:24:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.134.31.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/engine1/images/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-27 16:24:58 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:50616: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.244.83.178
description:
Jan 27 16:25:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.244.83.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/engine1/images/engine1/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
description:
Jan 27 16:25:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.99.210
description:
Jan 27 16:25:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.99.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 27 16:25:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
description:
2025-01-27 16:25:36 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:44272: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.244.83.178
description:
2025-01-27 16:25:44 dovecot_plain authenticator failed for h80-244-83-178.cust.bredband2.com [80.244.83.178]:35164: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-27 16:25:44 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:28051: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
description:
2025-01-27 16:25:13 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:59524: 535 Incorrect authentication data (set_id=eng88b00888y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.25.140.211
description:
Jan 27 16:25:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.25.140.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.25.140.211
description:
2025-01-27 16:25:25 dovecot_plain authenticator failed for ([112.25.140.211]) [112.25.140.211]:59472: 535 Incorrect authentication data (set_id=eng88b00888y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/engine1/images/engine1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.195.66
description:
Jan 27 16:26:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.195.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-27 16:26:22 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:58932: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.111.233
description:
47.128.111.233 - - [27/Jan/2025:16:26:45 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22388908 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/624558?panel=http_client" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.111.233


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 27 16:26:03 ait sshd[3055538]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 27 16:26:03 ait sshd[3055538]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.156.195.35
description:
2025-01-27 16:26:36 dovecot_login authenticator failed for ([117.156.195.35]) [117.156.195.35]:52853: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.156.195.35
description:
Jan 27 16:26:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.156.195.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.129.195.66
description:
2025-01-27 16:26:04 dovecot_plain authenticator failed for ([203.129.195.66]) [203.129.195.66]:52015: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.195.208.171
description:
Jan 27 16:26:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.195.208.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.195.208.171
description:
2025-01-27 16:26:15 dovecot_plain authenticator failed for ([221.195.72.195]) [221.195.208.171]:59608: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 27 16:26:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 27 16:27:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 27 16:27:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-01-27 16:27:11 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:34754: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.118.9.59
description:
Jan 27 16:27:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.118.9.59 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 27 16:27:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
description:
Jan 27 16:27:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.170.44.62
description:
[2025-01-27 16:27:07 +0100] info [webmaild] 93.170.44.62 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/css/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 16:27:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Jan 27 16:27:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 16:27:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-27 16:27:11 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:47467: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.21
description:
2025-01-27 16:27:21 dovecot_plain authenticator failed for ([122.228.225.21]) [122.228.225.21]:48979: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-27 16:27:26 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:48333: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.85.42.195
description:
Jan 27 16:27:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.85.42.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.118.9.59
description:
2025-01-27 16:27:56 dovecot_plain authenticator failed for ([123.118.9.75]) [123.118.9.59]:37565: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
description:
Jan 27 16:27:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.21
description:
Jan 27 16:27:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.85.42.195
description:
2025-01-27 16:27:43 dovecot_plain authenticator failed for ([1.85.42.195]) [1.85.42.195]:46290: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.84.60
description:
Jan 27 16:27:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.84.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.84.60
description:
2025-01-27 16:27:46 dovecot_plain authenticator failed for (60.84.41.31.ip4.feromedia.eu) [31.41.84.60]:56431: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 27 16:28:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 27 16:27:42 ait sshd[3056877]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 27 16:27:42 ait sshd[3056877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=aitopen


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-27 16:28:00 dovecot_login authenticator failed for ([211.105.223.49]) [211.105.223.49]:52426: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-01-27 16:27:10 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:49634: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
description:
2025-01-27 16:28:51 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:32658: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.150.213.239
description:
Jan 27 16:28:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.150.213.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
description:
Jan 27 16:28:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 27 16:28:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-01-27 16:28:35 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:39325: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
description:
Jan 27 16:28:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Jan 27 16:28:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-01-27 16:28:54 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br [186.247.238.94]:35333: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-27 16:28:26 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:52046: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Jan 27 16:28:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
description:
2025-01-27 16:28:01 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:56495: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-27 16:28:02 dovecot_plain authenticator failed for ([218.150.170.10]) [218.150.170.10]:59442: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/js/engine1/engine1/js/images/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
description:
2025-01-27 16:28:15 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:39368: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 27 16:28:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-27 16:28:52 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:33168: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 27 16:28:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.150.213.239
description:
2025-01-27 16:28:14 dovecot_plain authenticator failed for ([103.150.213.239]) [103.150.213.239]:51091: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-27 16:28:15 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:12968: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.150.123.106
description:
Jan 27 16:29:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.150.123.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-27 16:29:46 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:52486: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.54.26
description:
47.128.54.26 - - [27/Jan/2025:16:29:58 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26704774 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/11/?filter_course-language=120&filtering=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.54.26


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-27 16:29:04 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:38000: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.255.34.171
description:
2025-01-27 16:29:20 dovecot_plain authenticator failed for broadband-188-255-34-171.ip.moscow.rt.ru [188.255.34.171]:56942: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/css/js/engine1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.233.190
description:
Jan 27 16:29:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 27 16:29:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 27 16:29:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
description:
2025-01-27 16:29:05 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:53100: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-27 16:29:19 dovecot_login authenticator failed for ([113.160.140.138]) [113.160.140.138]:60652: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.233.190
description:
2025-01-27 16:29:37 dovecot_plain authenticator failed for ([144.48.233.190]) [144.48.233.190]:60240: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-27 16:29:55 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:13822: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.255.34.171
description:
Jan 27 16:29:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.255.34.171 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.112.59.132
description:
[2025-01-27 16:29:36 +0100] info [webmaild] 103.112.59.132 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.217.162
description:
Jan 27 16:29:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.217.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.70
description:
Jan 27 16:29:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 27 16:29:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.47.214
description:
Jan 27 16:29:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.237.47.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 27 16:29:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.150.123.106
description:
2025-01-27 16:29:24 dovecot_plain authenticator failed for ([61.150.123.106]) [61.150.123.106]:60196: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Jan 27 16:29:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
description:
2025-01-27 16:29:22 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:55564: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.217.162
description:
2025-01-27 16:29:40 dovecot_plain authenticator failed for ([124.115.217.162]) [124.115.217.162]:52078: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
description:
Jan 27 16:29:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.70
description:
2025-01-27 16:29:41 dovecot_login authenticator failed for ([104.241.238.70]) [104.241.238.70]:54942: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-01-27 16:30:00 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:58720: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.101.36.159
description:
Jan 27 16:30:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.101.36.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-01-27 16:30:33 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:54411: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.188.18.25
description:
2025-01-27 16:30:46 dovecot_login authenticator failed for ([118.188.18.25]) [118.188.18.25]:36124: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 27 16:30:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-27 16:30:58 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:41998: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.248.40.194
description:
2025-01-27 16:30:08 dovecot_login authenticator failed for ([103.248.40.194]) [103.248.40.194]:40252: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.245
description:
2025-01-27 16:30:30 dovecot_login authenticator failed for ([104.241.234.245]) [104.241.234.245]:42648: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-27 16:30:42 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:19133: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 16:30:51 ait sshd[3059362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-27 16:30:56 dovecot_plain authenticator failed for ([196.191.212.235]) [213.55.85.202]:2458: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/data1/images/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-01-27 16:30:09 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:56565: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 27 16:30:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.188.18.25
description:
Jan 27 16:30:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.188.18.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 27 16:30:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.248.40.194
description:
Jan 27 16:30:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.248.40.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.245
description:
Jan 27 16:30:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Jan 27 16:30:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 16:30:51 ait sshd[3059362]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.128.97
description:
Jan 27 16:31:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.128.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 27 16:31:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.130.181.74
description:
2025-01-27 16:31:56 dovecot_login authenticator failed for ([103.65.227.71]) [114.130.181.74]:40239: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.239.109.147
description:
Jan 27 16:31:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.239.109.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Jan 27 16:31:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-27 16:31:30 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:7864: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
description:
2025-01-27 16:31:14 dovecot_plain authenticator failed for syn-172-090-128-097.res.spectrum.com [172.90.128.97]:49886: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
description:
2025-01-27 16:31:16 dovecot_plain authenticator failed for ([14.37.206.76]) [14.37.206.76]:33563: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
description:
Jan 27 16:31:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.239.109.147
description:
2025-01-27 16:31:17 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:62360: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 27 16:31:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.130.181.74
description:
Jan 27 16:31:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.130.181.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Jan 27 16:31:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.172.38
description:
2025-01-27 16:31:04 dovecot_login authenticator failed for ([221.165.172.38]) [221.165.172.38]:35870: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-01-27 16:31:04 dovecot_plain authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:11469: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-27 16:31:31 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:56357: 535 Incorrect authentication data (set_id=accounts)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/engine1/data1/images/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 27 16:32:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 27 16:32:11 ait sshd[3060552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.156.85
description:
2025-01-27 16:32:40 dovecot_plain authenticator failed for (abts-north-static-085.156.160.122.airtelbroadband.in) [122.160.156.85]:50446: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.122.143
description:
Jan 27 16:32:01 ait sshd[3060432]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.122.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.89.141
description:
Jan 27 16:32:03 ait sshd[3060472]: pam_imunify(sshd:auth): [IM360_RBL] The IP 68.183.89.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.152
description:
2025-01-27 16:32:11 dovecot_plain authenticator failed for (nsg-corporate-152.227.187.122.airtel.in) [122.187.227.152]:51349: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.189
description:
Jan 27 16:32:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/data1/css/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.152
description:
Jan 27 16:32:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.57.55
description:
2025-01-27 16:32:28 dovecot_login authenticator failed for (55.57.251.198.in-addr.arpa) [198.251.57.55]:34009: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.189
description:
2025-01-27 16:32:43 dovecot_login authenticator failed for ([111.61.176.189]) [111.61.176.189]:29120: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 68.183.89.141
description:
Jan 27 16:32:03 ait sshd[3060472]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=68.183.89.141


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.216
description:
Jan 27 16:32:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.216 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.122.143
description:
Jan 27 16:32:01 ait sshd[3060432]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.122.143  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.216
description:
2025-01-27 16:32:30 dovecot_plain authenticator failed for (201-234-106-216.static.impsat.net.ar) [201.234.106.216]:49165: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.156.85
description:
Jan 27 16:32:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.156.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-27 16:32:07 dovecot_login authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:43547: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 27 16:32:11 ait sshd[3060552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Jan 27 16:32:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.251.57.55
description:
Jan 27 16:32:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.251.57.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-01-27 16:32:27 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:43012: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.141.177.55
description:
Jan 27 16:33:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.141.177.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.160.25.51
description:
Jan 27 16:33:27 ait sshd[3061470]: pam_imunify(sshd:auth): [IM360_RBL] The IP 217.160.25.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.71.121.54
description:
2025-01-27 16:33:40 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:49471: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.28.66.78
description:
Jan 27 16:33:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.28.66.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.28.66.78
description:
2025-01-27 16:33:54 dovecot_plain authenticator failed for ([62.28.66.78]) [62.28.66.78]:58491: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.141.177.55
description:
2025-01-27 16:33:35 dovecot_plain authenticator failed for ([209.141.177.55]) [209.141.177.55]:35175: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.71.121.54
description:
Jan 27 16:33:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.71.121.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.225.176.238
description:
Jan 27 16:33:04 ait sshd[3061200]: pam_imunify(sshd:auth): [IM360_RBL] The IP 50.225.176.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-27 16:33:09 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:52099: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 27 16:33:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 217.160.25.51
description:
Jan 27 16:33:27 ait sshd[3061470]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=217.160.25.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.198.60
description:
Jan 27 16:33:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.198.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-27 16:33:24 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:43634: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/css/engine1/js/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 217.160.25.51
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:www.lemsas.net||WPU:www.lemsas.net||RSV:6.65||T:APACHE||MV:16-33.217.160.25.51


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.198.60
description:
2025-01-27 16:33:54 dovecot_login authenticator failed for ([121.189.198.60]) [121.189.198.60]:46044: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 50.225.176.238
description:
Jan 27 16:33:04 ait sshd[3061200]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.225.176.238


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 27 16:33:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.160.25.51
description:
[2025-01-27 16:33:05 +0100] info [whostmgrd] 217.160.25.51 - www.lemsas.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Jan 27 16:34:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.130
description:
2025-01-27 16:34:24 dovecot_plain authenticator failed for ([211.109.93.130]) [211.109.93.130]:37414: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.215.71
description:
Jan 27 16:34:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.215.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.232.155.240
description:
2025-01-27 16:34:46 dovecot_login authenticator failed for (static.vnpt.vn) [14.232.155.240]:36940: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Jan 27 16:34:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 27 16:34:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.137.21
description:
Jan 27 16:34:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.137.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-01-27 16:34:54 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:59721: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.67.18
description:
2025-01-27 16:34:05 dovecot_plain authenticator failed for ([112.91.67.18]) [112.91.67.18]:58165: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-01-27 16:34:21 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:44612: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Jan 27 16:34:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.215.71
description:
2025-01-27 16:34:36 dovecot_plain authenticator failed for ([5.30.215.71]) [5.30.215.71]:41370: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.67.18
description:
Jan 27 16:34:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.67.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 16:34:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 27 16:34:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.137.21
description:
2025-01-27 16:34:50 dovecot_login authenticator failed for ([119.203.137.21]) [119.203.137.21]:52472: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.145.163
description:
Jan 27 16:34:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.145.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-27 16:34:28 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:59277: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-27 16:34:31 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:13989: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 27 16:34:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Jan 27 16:34:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.145.163
description:
2025-01-27 16:34:13 dovecot_plain authenticator failed for ([121.11.145.163]) [121.11.145.163]:60744: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.250.249.12
description:
2025-01-27 16:34:46 dovecot_plain authenticator failed for ([45.250.249.12]) [45.250.249.12]:48436: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.250.249.12
description:
Jan 27 16:34:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.250.249.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 16:34:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-01-27 16:34:51 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:45532: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/css/js/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.130
description:
Jan 27 16:34:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.145.47
description:
2025-01-27 16:34:25 dovecot_login authenticator failed for (223-197-145-47.static.imsbiz.com) [223.197.145.47]:59414: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-27 16:34:35 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:35427: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-27 16:34:42 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:41676: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 27 16:35:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.5.49
description:
Jan 27 16:35:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.5.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.161
description:
Jan 27 16:35:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Jan 27 16:35:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 27 16:35:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-27 16:35:44 dovecot_plain authenticator failed for (46.30.161.197.access.ipnet.ua) [46.30.161.197]:40963: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 27 16:35:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-27 16:35:06 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:45440: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
description:
2025-01-27 16:35:21 dovecot_plain authenticator failed for ([101.13.5.49]) [101.13.5.49]:52612: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.161
description:
2025-01-27 16:35:24 dovecot_plain authenticator failed for ([112.102.48.161]) [112.102.48.161]:53702: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-01-27 16:35:34 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:33002: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.44
description:
2025-01-27 16:36:31 dovecot_plain authenticator failed for ([207.219.222.44]) [207.219.222.44]:60677: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.136.172.98
description:
Jan 27 16:36:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.136.172.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Jan 27 16:36:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-01-27 16:36:08 dovecot_login authenticator failed for ([38.49.182.103]) [38.49.182.103]:48516: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.23.103
description:
2025-01-27 16:36:12 dovecot_login authenticator failed for ([115.23.23.103]) [115.23.23.103]:38252: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.23.103
description:
Jan 27 16:36:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.23.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 27 16:36:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-27 16:36:21 dovecot_login authenticator failed for ([119.200.229.33]) [119.200.229.33]:57418: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-27 16:36:23 dovecot_login authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:56892: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.225.176.238
description:
Jan 27 16:36:31 ait sshd[3063641]: pam_imunify(sshd:auth): [IM360_RBL] The IP 50.225.176.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.136.172.98
description:
2025-01-27 16:36:03 dovecot_plain authenticator failed for ([197.136.236.1]) [197.136.172.98]:51442: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-27 16:36:14 dovecot_plain authenticator failed for ([111.91.178.253]) [111.91.178.253]:49410: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.44
description:
Jan 27 16:36:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.115.47.199
description:
Jan 27 16:36:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.115.47.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.115.47.199
description:
2025-01-27 16:36:13 dovecot_login authenticator failed for 24.115.47.199.res-cmts.hzl3.ptd.net [24.115.47.199]:47313: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 50.225.176.238
description:
Jan 27 16:36:31 ait sshd[3063641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.225.176.238  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.122.143
description:
Jan 27 16:36:42 ait sshd[3063704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.122.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.97
description:
2025-01-27 16:36:58 dovecot_login authenticator failed for ([193.32.162.97]) [193.32.162.97]:50041: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.97
description:
Jan 27 16:36:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-27 16:36:01 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:47750: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.34.128.40
description:
Jan 27 16:36:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.34.128.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 27 16:36:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.122.143
description:
Jan 27 16:36:42 ait sshd[3063704]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.122.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 27 16:36:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.128.40
description:
2025-01-27 16:36:20 dovecot_plain authenticator failed for 1-34-128-40.hinet-ip.hinet.net [1.34.128.40]:58717: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-27 16:37:33 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:39529: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.81
description:
2025-01-27 16:37:33 dovecot_login authenticator failed for ([193.32.162.81]) [193.32.162.81]:56122: 535 Incorrect authentication data (set_id=fax)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.225.176.238
description:
Jan 27 16:37:40 ait sshd[3064564]: pam_imunify(sshd:auth): [IM360_RBL] The IP 50.225.176.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 137.184.122.143
description:
Jan 27 16:37:57 ait sshd[3064812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=137.184.122.143


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 27 16:37:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.73
description:
Jan 27 16:37:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 27 16:37:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 27 16:37:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.81
description:
Jan 27 16:37:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.73
description:
2025-01-27 16:37:19 dovecot_login authenticator failed for ([193.32.162.73]) [193.32.162.73]:53003: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-27 16:37:19 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:49214: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.83
description:
2025-01-27 16:37:21 dovecot_login authenticator failed for ([193.32.162.83]) [193.32.162.83]:64972: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 50.225.176.238
description:
Jan 27 16:37:40 ait sshd[3064564]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=50.225.176.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.66
description:
2025-01-27 16:37:03 dovecot_login authenticator failed for ([193.32.162.66]) [193.32.162.66]:63810: 535 Incorrect authentication data (set_id=backup)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/js/js/css/css/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.161
description:
2025-01-27 16:37:50 dovecot_plain authenticator failed for (161-179-53-194.mairnet.net) [194.53.179.161]:55566: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.106
description:
Jan 27 16:37:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.161
description:
Jan 27 16:37:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 16:37:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
description:
2025-01-27 16:38:00 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:49576: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.106
description:
2025-01-27 16:37:45 dovecot_login authenticator failed for 111-70-49-106.emome-ip.hinet.net [111.70.49.106]:46414: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.184.122.143
description:
Jan 27 16:37:57 ait sshd[3064812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 137.184.122.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 16:37:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.83
description:
Jan 27 16:37:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.66
description:
Jan 27 16:37:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
description:
Jan 27 16:37:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-27 16:38:19 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:20927: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 27 16:38:50 ait sshd[3065396]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/js/js/css/css/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.254
description:
2025-01-27 16:38:24 dovecot_plain authenticator failed for (nsg-corporate-254.230.187.122.airtel.in) [122.187.230.254]:33587: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.102.90
description:
Jan 27 16:38:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.102.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.102.90
description:
2025-01-27 16:38:44 dovecot_plain authenticator failed for ([117.32.102.90]) [117.32.102.90]:41471: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.111.22
description:
Jan 27 16:38:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.111.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.111.22
description:
2025-01-27 16:38:33 dovecot_login authenticator failed for ([110.34.111.22]) [110.34.111.22]:34380: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-01-27 16:38:33 dovecot_plain authenticator failed for ([183.196.174.235]) [183.196.174.235]:15183: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 27 16:38:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 27 16:38:50 ait sshd[3065396]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-27 16:38:54 dovecot_plain authenticator failed for ([200.223.192.254]) [200.223.192.254]:35672: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.85.152.128
description:
[2025-01-27 16:38:47 +0100] info [webmaild] 181.85.152.128 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.89.199
description:
Jan 27 16:38:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.89.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 27 16:38:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.46
description:
Jan 27 16:38:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Jan 27 16:38:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.66.113.58
description:
Jan 27 16:38:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.66.113.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-27 16:38:01 dovecot_plain authenticator failed for ([110.7.52.183]) [110.7.52.183]:59968: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.89.199
description:
2025-01-27 16:38:04 dovecot_plain authenticator failed for ([223.171.89.199]) [223.171.89.199]:39698: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 27 16:38:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-27 16:38:19 dovecot_plain authenticator failed for ([41.220.3.113]) [41.220.3.101]:9981: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.254
description:
Jan 27 16:38:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.46
description:
2025-01-27 16:38:23 dovecot_plain authenticator failed for ([112.91.253.46]) [112.91.253.46]:60854: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.66.113.58
description:
2025-01-27 16:38:34 dovecot_plain authenticator failed for ([183.66.113.58]) [183.66.113.58]:60390: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 16:39:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 16:39:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/data1/images/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.155.88
description:
[2025-01-27 16:39:07 +0100] info [webmaild] 45.185.155.88 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.113
description:
2025-01-27 16:39:55 dovecot_plain authenticator failed for (113.20.167.124.adsl-pool.sx.cn) [124.167.20.113]:51612: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.110.255
description:
[2025-01-27 16:40:06 +0100] info [webmaild] 177.72.110.255 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.214.168.101
description:
Jan 27 16:40:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.214.168.101 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/data1/images/js/data1/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.243.187
description:
Jan 27 16:40:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.243.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
description:
2025-01-27 16:40:21 dovecot_login authenticator failed for ([103.194.243.187]) [103.194.243.187]:54872: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 27 16:40:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.214.168.101
description:
2025-01-27 16:40:11 dovecot_plain authenticator failed for d-24-214-168-101.oh.cpe.breezeline.net [24.214.168.101]:49014: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 27 16:40:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-27 16:40:37 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:59238: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.220
description:
2025-01-27 16:41:13 dovecot_login authenticator failed for ([104.241.238.220]) [104.241.238.220]:54655: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-27 16:41:34 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:32879: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/css/data1/js/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.220
description:
Jan 27 16:41:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.143.14
description:
Jan 27 16:41:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.143.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.125.124.14
description:
2025-01-27 16:41:30 dovecot_login authenticator failed for (vtx-b-124-014.virtex.com.br) [179.125.124.14]:49728: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 27 16:41:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 16:41:16 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:48680: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 16:41:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.125.124.14
description:
Jan 27 16:41:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.125.124.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-27 16:41:01 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:56990: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 16:41:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.143.14
description:
2025-01-27 16:41:22 dovecot_login authenticator failed for ([103.251.143.14]) [103.251.143.14]:33134: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Jan 27 16:42:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 27 16:42:04 ait sshd[3067651]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 27 16:42:04 ait sshd[3067651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.121.62.127
description:
[2025-01-27 16:42:31 +0100] info [webmaild] 103.121.62.127 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.228.105.192
description:
Jan 27 16:42:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.228.105.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.228.105.192
description:
2025-01-27 16:42:50 dovecot_plain authenticator failed for ([58.228.105.192]) [58.228.105.192]:34012: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-01-27 16:42:22 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:43417: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 16:42:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Jan 27 16:42:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-01-27 16:42:06 dovecot_plain authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:41237: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 27 16:42:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.137.216.138
description:
[2025-01-27 16:42:34 +0100] info [webmaild] 177.137.216.138 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.53.187
description:
Jan 27 16:42:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.53.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.53.187
description:
2025-01-27 16:42:40 dovecot_plain authenticator failed for ([122.185.53.187]) [122.185.53.187]:42652: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/engine1/images/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.32.45.10
description:
2025-01-27 16:43:44 dovecot_plain authenticator failed for ([125.32.45.10]) [125.32.45.10]:40396: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-27 16:43:08 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:64134: 535 Incorrect authentication data (set_id=helpdesk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.106.238.213
description:
[2025-01-27 16:43:18 +0100] info [webmaild] 103.106.238.213 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-27 16:43:19 dovecot_login authenticator failed for ([223.26.225.129]) [210.206.24.234]:45548: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 27 16:43:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-27 16:43:34 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:55110: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.32.45.10
description:
Jan 27 16:43:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.32.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 16:43:53 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:57595: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/images/engine1/engine1/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 27 16:43:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 16:43:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 27 16:43:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 16:43:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.104.41
description:
Jan 27 16:43:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.104.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.104.41
description:
2025-01-27 16:43:33 dovecot_plain authenticator failed for visaustralia.com [216.70.104.41]:43480: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 16:44:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/data1/images/css/data1/images/js/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Jan 27 16:44:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.234.121.57
description:
Jan 27 16:44:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.234.121.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-27 16:44:39 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:45722: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.7
description:
Jan 27 16:44:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.7
description:
2025-01-27 16:44:54 dovecot_login authenticator failed for (m121-202-152-7.smartone.com) [121.202.152.7]:3035: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.164
description:
Jan 27 16:44:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
description:
2025-01-27 16:44:43 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:37144: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-01-27 16:44:45 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:51931: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.250
description:
Jan 27 16:44:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-01-27 16:44:57 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:53118: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Jan 27 16:44:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-01-27 16:44:06 dovecot_login authenticator failed for (host-115-208-static-98-201.uninet-ide.com.mx) [201.98.208.115]:54346: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
description:
2025-01-27 16:44:16 dovecot_plain authenticator failed for (shlovest) [65.20.204.164]:39982: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 27 16:44:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Jan 27 16:44:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.24.32.183
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:16-44.95.24.32.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.60.146
description:
Jan 27 16:44:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.250
description:
2025-01-27 16:44:56 dovecot_plain authenticator failed for ([121.202.155.250]) [121.202.155.250]:8260: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.99.28
description:
[2025-01-27 16:44:56 +0100] info [webmaild] 169.224.99.28 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 217.160.25.51
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:16-45.217.160.25.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 27 16:45:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.178
description:
2025-01-27 16:45:27 dovecot_plain authenticator failed for 202-4-196-178.static.pccw-hkt.com [202.4.196.178]:48497: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.148.78
description:
Jan 27 16:45:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.148.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.178
description:
Jan 27 16:45:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.148.78
description:
2025-01-27 16:45:35 dovecot_plain authenticator failed for broadband-37-110-148-78.ip.moscow.rt.ru [37.110.148.78]:52610: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-27 16:45:38 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:56704: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 87.249.38.253
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:16-45.87.249.38.253


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 27 16:45:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-27 16:45:24 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:34426: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Jan 27 16:46:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
description:
2025-01-27 16:46:30 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:47074: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.38.208.229
description:
2025-01-27 16:46:58 dovecot_plain authenticator failed for p380230-obmd01.tokyo.ocn.ne.jp [60.38.208.229]:49875: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
description:
Jan 27 16:46:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 27 16:46:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-01-27 16:46:21 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:45646: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
description:
Jan 27 16:46:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-01-27 16:46:40 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:37389: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-01-27 16:46:43 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:56956: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
description:
2025-01-27 16:46:55 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:33228: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 27 16:46:03 ait sshd[3070565]: Invalid user universitypublishing from 116.122.157.193 port 36692


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 27 16:46:03 ait sshd[3070565]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 16:46:03 ait sshd[3070565]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.145.205
description:
Jan 27 16:46:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.145.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.145.205
description:
2025-01-27 16:46:41 dovecot_plain authenticator failed for 205.145.48.116.static.netvigator.com [116.48.145.205]:55648: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.45.253
description:
[2025-01-27 16:46:41 +0100] info [webmaild] 179.189.45.253 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
description:
Jan 27 16:46:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.116.156.198
description:
Jan 27 16:46:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.116.156.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.116.156.198
description:
2025-01-27 16:46:56 dovecot_login authenticator failed for ([116.116.156.198]) [116.116.156.198]:50569: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 27 16:47:12 ait sshd[3071133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-27 16:47:05 dovecot_plain authenticator failed for ([218.98.160.119]) [218.98.160.117]:42186: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 27 16:47:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.248.1.199
description:
2025-01-27 16:47:24 dovecot_plain authenticator failed for ([87.248.1.199]) [87.248.1.199]:58029: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 27 16:47:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.34.68.77
description:
Jan 27 16:47:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.34.68.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.172.79.206
description:
2025-01-27 16:47:16 dovecot_plain authenticator failed for ([211.172.79.206]) [211.172.79.206]:49434: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.72.89.67
description:
Jan 27 16:47:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.72.89.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-27 16:47:36 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:55528: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 27 16:47:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.10.79.34
description:
Jan 27 16:47:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.10.79.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/images/css/engine1/engine1/data1/images/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/images


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.72.89.67
description:
2025-01-27 16:47:36 dovecot_plain authenticator failed for 211-72-89-67.hinet-ip.hinet.net [211.72.89.67]:58383: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.172.79.206
description:
Jan 27 16:47:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.172.79.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-27 16:47:19 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net (ip193.ip-87-98-249.eu) [51.75.24.107]:15235: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.248.1.199
description:
Jan 27 16:47:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.248.1.199 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.59.114.152
domain: mobile.ait-edu.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:16-47.139.59.114.152||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.10.79.34
description:
2025-01-27 16:47:26 dovecot_plain authenticator failed for ([59.10.79.34]) [59.10.79.34]:32984: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 27 16:47:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
description:
Jan 27 16:47:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.34.68.77
description:
2025-01-27 16:47:11 dovecot_plain authenticator failed for ([111.34.68.77]) [111.34.68.77]:50408: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 139.59.114.152
domain: mobile.ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/upload/kcfinder/upload.php||SC:/home/titlemas/public_html/mobile.ait-edu.us/upload


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.223
description:
Jan 27 16:47:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.223
description:
2025-01-27 16:47:48 dovecot_login authenticator failed for ([93.182.160.223]) [93.182.160.223]:34864: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-27 16:47:38 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:37724: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-01-27 16:47:52 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:4504: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 27 16:47:12 ait sshd[3071133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-01-27 16:48:43 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:45057: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.65.53
description:
2025-01-27 16:48:44 dovecot_plain authenticator failed for ([213.230.65.53]) [213.230.65.53]:34350: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.126.34.84
description:
2025-01-27 16:48:34 dovecot_plain authenticator failed for (109-126-34-84.pptp.vladlink.net) [109.126.34.84]:51924: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Jan 27 16:48:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 27 16:48:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.78.68
description:
Jan 27 16:48:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.78.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.78.68
description:
2025-01-27 16:48:35 dovecot_plain authenticator failed for 60-249-78-68.hinet-ip.hinet.net [60.249.78.68]:37650: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/engine1/data1/images/data1/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.118.123
description:
Jan 27 16:48:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.118.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.40.72.101
description:
2025-01-27 16:48:15 dovecot_plain authenticator failed for ([89.40.72.101]) [89.40.72.101]:54864: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-27 16:48:25 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:54422: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.91.173
description:
[2025-01-27 16:48:29 +0100] info [webmaild] 131.221.91.173 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.180.102
description:
2025-01-27 16:48:12 dovecot_plain authenticator failed for 80-15-180-102.ftth.fr.orangecustomers.net [80.15.180.102]:58176: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.180.102
description:
Jan 27 16:48:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.180.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.40.72.101
description:
Jan 27 16:48:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.40.72.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 27 16:48:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-27 16:48:16 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:36036: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.118.123
description:
2025-01-27 16:48:23 dovecot_plain authenticator failed for ([60.174.118.123]) [60.174.118.123]:43547: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.126.34.84
description:
Jan 27 16:48:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.126.34.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.238.237.254
description:
2025-01-27 16:48:42 dovecot_plain authenticator failed for ([211.238.237.254]) [211.238.237.254]:38398: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.238.237.254
description:
Jan 27 16:48:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.238.237.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.65.53
description:
Jan 27 16:48:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.65.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 27 16:49:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.137.78.40
description:
Jan 27 16:49:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.137.78.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.18.21
description:
2025-01-27 16:49:34 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:48674: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 27 16:49:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 27 16:49:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-27 16:49:27 dovecot_login authenticator failed for ([14.38.28.126]) [14.88.228.202]:60740: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
description:
Jan 27 16:49:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 27 16:49:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-27 16:49:41 dovecot_plain authenticator failed for ([175.206.105.126]) [175.206.105.126]:46430: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/js/css/data1/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 27 16:49:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.22.171.65
description:
[2025-01-27 16:49:44 +0100] info [webmaild] 177.22.171.65 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-27 16:49:47 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:21048: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.80.226
description:
Jan 27 16:49:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 16:49:57 ait sshd[3073384]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-27 16:49:12 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:53881: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.137.78.40
description:
2025-01-27 16:49:28 dovecot_plain authenticator failed for 40.ip-79-137-78.eu [79.137.78.40]:55682: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 27 16:49:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.150.87.70
description:
Jan 27 16:49:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.150.87.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-27 16:49:38 dovecot_login authenticator failed for ([102.53.15.56]) [102.53.15.56]:51873: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.80.226
description:
2025-01-27 16:49:57 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:44237: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.163.102
description:
Jan 27 16:49:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.163.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.191.163.102
description:
2025-01-27 16:49:20 dovecot_plain authenticator failed for ([61.191.163.102]) [61.191.163.102]:36606: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.18.126.17
description:
Jan 27 16:49:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.18.126.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.18.126.17
description:
2025-01-27 16:49:20 dovecot_plain authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:44136: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.150.87.70
description:
2025-01-27 16:49:39 dovecot_plain authenticator failed for ([193.150.87.70]) [193.150.87.70]:33052: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-27 16:49:53 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:35850: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 27 16:49:57 ait sshd[3073384]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-27 16:49:31 dovecot_plain authenticator failed for ([211.105.213.144]) [211.105.213.144]:38002: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 27 16:49:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 27 16:49:52 ait sshd[3073343]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.249
description:
2025-01-27 16:50:09 dovecot_login authenticator failed for ([104.241.233.249]) [104.241.233.249]:47941: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/data1/engine1/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.82
description:
2025-01-27 16:50:36 dovecot_plain authenticator failed for (nsg-corporate-82.227.187.122.airtel.in) [122.187.227.82]:34861: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.114.101
description:
2025-01-27 16:50:48 dovecot_plain authenticator failed for ([119.160.114.101]) [119.160.114.101]:61189: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
description:
Jan 27 16:50:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.54.228.128
description:
[2025-01-27 16:50:21 +0100] info [webmaild] 177.54.228.128 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.82
description:
Jan 27 16:50:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.114.101
description:
Jan 27 16:50:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.114.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-27 16:50:46 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:62588: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.249
description:
Jan 27 16:50:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.249 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.249.51.151
description:
Jan 27 16:50:21 ait sshd[3073774]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.249.51.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 27 16:50:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 27 16:50:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-27 16:50:47 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:43292: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-27 16:50:49 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:41996: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.249.51.151
description:
Jan 27 16:50:21 ait sshd[3073774]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.249.51.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 16:50:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
description:
2025-01-27 16:50:59 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:48771: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 27 16:50:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-27 16:51:01 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:40300: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.156.227
description:
2025-01-27 16:51:40 dovecot_plain authenticator failed for ([218.23.156.227]) [218.23.156.227]:52620: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-01-27 16:51:48 dovecot_login authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:21095: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.174.44.210
description:
[2025-01-27 16:51:59 +0100] info [webmaild] 103.174.44.210 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.241.59.150
description:
2025-01-27 16:51:03 dovecot_login authenticator failed for (static.vnpt.vn) [14.241.59.150]:52534: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.156.227
description:
Jan 27 16:51:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.156.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.46.203.158
description:
2025-01-27 16:51:55 dovecot_plain authenticator failed for ([211.46.203.158]) [211.46.203.158]:46415: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.47.20.229
description:
2025-01-27 16:51:28 dovecot_plain authenticator failed for ([92.202.82.102]) [154.47.20.229]:41547: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.46.203.158
description:
Jan 27 16:51:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.46.203.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.241.59.150
description:
Jan 27 16:51:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.241.59.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/css/css/css/donate.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 16:51:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.47.20.229
description:
Jan 27 16:51:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.47.20.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 27 16:51:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-27 16:51:06 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:20446: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 16:51:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 27 16:51:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.142.238
description:
2025-01-27 16:52:07 dovecot_login authenticator failed for ([114.143.224.97]) [182.156.142.238]:62559: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-01-27 16:52:24 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:59108: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 27 16:52:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-27 16:52:08 dovecot_plain authenticator failed for ([183.167.196.62]) [183.167.196.62]:57909: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.142.238
description:
Jan 27 16:52:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.142.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 27 16:52:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
description:
Jan 27 16:52:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
description:
2025-01-27 16:52:13 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:4682: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Jan 27 16:52:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 27 16:52:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/engine1/engine1/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Jan 27 16:52:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-01-27 16:52:46 dovecot_plain authenticator failed for (corporativo.static.gvt.net.br) [189.115.93.183]:45624: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-27 16:52:26 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (115-64-230-179.static.tpgi.com.au) [110.175.220.250]:47806: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.168.101.105
description:
Jan 27 16:52:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.168.101.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.168.101.105
description:
2025-01-27 16:52:30 dovecot_plain authenticator failed for ([81.168.101.105]) [81.168.101.105]:57386: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-27 16:52:21 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:33316: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.238.104.74
description:
Jan 27 16:53:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.238.104.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Jan 27 16:53:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.249.51.151
description:
Jan 27 16:53:21 ait sshd[3075982]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.249.51.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.213
description:
2025-01-27 16:53:47 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.213]:53144: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
description:
2025-01-27 16:53:52 dovecot_login authenticator failed for ([116.114.84.170]) [116.114.84.170]:34529: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.43.35
description:
Jan 27 16:53:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.43.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.127.43.35
description:
2025-01-27 16:53:12 dovecot_plain authenticator failed for ([154.127.43.35]) [154.127.43.35]:39126: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 27 16:53:18 ait sshd[3075919]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.246.9.146
description:
2025-01-27 16:53:26 dovecot_plain authenticator failed for ([180.166.163.26]) [58.246.9.146]:50434: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.238.104.74
description:
2025-01-27 16:53:15 dovecot_plain authenticator failed for ([124.238.104.74]) [124.238.104.74]:59668: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 27 16:53:18 ait sshd[3075919]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.249.51.151
description:
Jan 27 16:53:21 ait sshd[3075982]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.249.51.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.3.117.0
description:
[2025-01-27 16:53:36 +0100] info [webmaild] 188.3.117.0 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 27 16:53:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.170
description:
Jan 27 16:53:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.170 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.123.102.192
description:
[2025-01-27 16:53:08 +0100] info [webmaild] 201.123.102.192 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 27 16:53:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-27 16:53:43 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:50914: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 27 16:53:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-01-27 16:53:23 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:57477: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.213
description:
Jan 27 16:53:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Jan 27 16:53:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Jan 27 16:53:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 27 16:53:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-01-27 16:53:13 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:55494: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.246.9.146
description:
Jan 27 16:53:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.246.9.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-27 16:53:24 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:50541: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-27 16:53:28 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:44522: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-01-27 16:53:28 dovecot_plain authenticator failed for 95-87-225-236.ip.btc-net.bg (95-87-225-236.net1.bg) [95.87.225.236]:48321: 535 Incorrect authentication data (set_id=amadam)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/data1/images/images/data1/images/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 27 16:54:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-27 16:54:00 dovecot_plain authenticator failed for ([101.91.236.162]) [218.78.92.131]:52046: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.249.51.151
description:
Jan 27 16:54:29 ait sshd[3076828]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.249.51.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.147.62.171
description:
Jan 27 16:54:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.147.62.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
description:
Jan 27 16:54:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-01-27 16:54:13 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:54076: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 16:54:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.71
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/data1/images/images/images/engine1/css/data1/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/data1


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 16:54:11 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:47291: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 16:54:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.164.135.251
description:
2025-01-27 16:54:14 dovecot_plain authenticator failed for ([121.164.135.251]) [121.164.135.251]:37833: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.130.173.74
description:
2025-01-27 16:54:16 dovecot_plain authenticator failed for ([5.130.173.74]) [5.130.173.74]:59742: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.249.51.151
description:
Jan 27 16:54:29 ait sshd[3076828]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.249.51.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 16:54:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.130.173.74
description:
Jan 27 16:54:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.130.173.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.62.171
description:
2025-01-27 16:54:53 dovecot_plain authenticator failed for ([103.147.62.171]) [103.147.62.171]:36558: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.38.74
description:
2025-01-27 16:54:02 dovecot_plain authenticator failed for ([118.122.38.74]) [118.122.38.74]:54068: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 119.249.51.151
description:
Jan 27 16:54:31 ait sshd[3076828]: Failed password for invalid user ubuntu from 119.249.51.151 port 45228 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.38.74
description:
Jan 27 16:54:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.38.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.164.135.251
description:
Jan 27 16:54:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.164.135.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-01-27 16:54:21 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:60881: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.213
description:
Jan 27 16:55:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
description:
Jan 27 16:55:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Jan 27 16:55:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-01-27 16:55:20 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:33030: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.201.85.163
description:
Jan 27 16:55:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.201.85.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 27 16:55:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.213
description:
2025-01-27 16:55:02 dovecot_login authenticator failed for ([195.178.110.213]) [195.178.110.213]:60476: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
description:
2025-01-27 16:55:10 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:36514: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.201.85.163
description:
2025-01-27 16:55:30 dovecot_plain authenticator failed for ([87.201.85.163]) [87.201.85.163]:36426: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 27 16:56:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.232.155.240
description:
2025-01-27 16:56:44 dovecot_login authenticator failed for (static.vnpt.vn) [14.232.155.240]:43412: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-27 16:56:01 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:48914: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.22.37.184
description:
Jan 27 16:56:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.22.37.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.232.155.240
description:
Jan 27 16:56:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.232.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-27 16:56:57 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:36109: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.22.37.184
description:
2025-01-27 16:56:04 dovecot_plain authenticator failed for ([217.22.37.184]) [217.22.37.184]:52857: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.17.6.119
description:
Jan 27 16:56:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.17.6.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.46.7
description:
Jan 27 16:56:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.46.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.46.7
description:
2025-01-27 16:56:30 dovecot_plain authenticator failed for 007.46.246.220.static.netvigator.com [220.246.46.7]:63055: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.120.227.186
description:
Jan 27 16:56:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.120.227.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Jan 27 16:56:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.75.227.38
description:
Jan 27 16:56:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.75.227.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.75.227.38
description:
2025-01-27 16:56:45 dovecot_plain authenticator failed for 128-75-227-38.broadband.corbina.ru [128.75.227.38]:59606: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.203.245.102
description:
Jan 27 16:56:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.203.245.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.245.102
description:
2025-01-27 16:56:18 dovecot_login authenticator failed for ([175.203.245.102]) [175.203.245.102]:37800: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.17.6.119
description:
2025-01-27 16:56:19 dovecot_plain authenticator failed for ([58.17.6.119]) [58.17.6.119]:49410: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.120.227.186
description:
2025-01-27 16:56:35 dovecot_plain authenticator failed for ([220.120.227.186]) [220.120.227.186]:49490: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


