# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
description:
2025-01-27 07:08:52 dovecot_login authenticator failed for host-196-47-172-253.afnet.net [196.47.172.253]:40146: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.175
description:
2025-01-27 07:09:03 dovecot_plain authenticator failed for ([121.202.153.175]) [121.202.153.175]:33117: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-01-27 07:09:05 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:46927: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
description:
Jan 27 07:09:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Jan 27 07:09:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-01-27 07:09:09 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:33142: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.248.3
description:
2025-01-27 07:09:22 dovecot_plain authenticator failed for ([176.113.248.3]) [176.113.248.3]:37170: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-27 07:10:14 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:48971: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-27 07:10:23 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:48450: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 27 07:09:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-01-27 07:09:57 dovecot_login authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:57230: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 27 07:10:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.33.2.165
description:
2025-01-27 07:10:23 dovecot_plain authenticator failed for (rucceproco) [41.33.2.165]:47822: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.169.19.43
description:
Jan 27 07:10:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.169.19.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.169.19.43
description:
2025-01-27 07:10:32 dovecot_plain authenticator failed for wsip-70-169-19-43.hr.hr.cox.net [70.169.19.43]:48912: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-27 07:10:00 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:58447: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.254.71
description:
2025-01-27 07:10:02 dovecot_plain authenticator failed for (bedneserle) [89.175.254.71]:57130: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.143.241.150
description:
2025-01-27 07:10:42 dovecot_plain authenticator failed for ([61.143.241.150]) [61.143.241.150]:39404: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.33.2.165
description:
Jan 27 07:10:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.33.2.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.143.241.150
description:
Jan 27 07:10:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.143.241.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 27 07:11:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Jan 27 07:10:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-01-27 07:10:53 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:33876: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-01-27 07:11:31 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:48574: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 07:12:07 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:53714: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Jan 27 07:12:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-01-27 07:12:19 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:54802: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Jan 27 07:12:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-12.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-01-27 07:12:27 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:34095: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.61.61.19
description:
2025-01-27 07:12:37 dovecot_plain authenticator failed for ([45.61.61.19]) [45.61.61.19]:49148: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 07:11:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.54.36
description:
Jan 27 07:11:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.54.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.206.91.51
description:
2025-01-27 07:11:59 dovecot_plain authenticator failed for (85-206-91-51.static.zebra.lt) [85.206.91.51]:52360: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.209.193.147
description:
2025-01-27 07:12:16 dovecot_plain authenticator failed for ([186.209.193.147]) [186.209.193.147]:45256: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-27 07:11:46 dovecot_plain authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:53693: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 07:11:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 07:11:55 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:58094: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.122.18.148
description:
Jan 27 07:12:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.122.18.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-01-27 07:12:34 dovecot_plain authenticator failed for ([95.0.252.76]) [95.0.252.76]:49666: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.61.209
description:
Jan 27 07:12:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.61.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.61.209
description:
2025-01-27 07:12:27 dovecot_plain authenticator failed for ([39.165.61.209]) [39.165.61.209]:60582: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.54.36
description:
2025-01-27 07:11:59 dovecot_plain authenticator failed for ([60.172.54.36]) [60.172.54.36]:51162: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.193.147
description:
Jan 27 07:12:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.193.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-01-27 07:12:16 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:36301: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Jan 27 07:12:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.122.18.148
description:
2025-01-27 07:12:23 dovecot_plain authenticator failed for ([202.122.18.148]) [202.122.18.148]:33754: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 27 07:13:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.208.177.56
description:
2025-01-27 07:12:57 dovecot_plain authenticator failed for ([74.208.177.56]) [74.208.177.56]:35914: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.119.68
description:
Jan 27 07:13:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.119.68 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.184.80.124
description:
[2025-01-27 07:13:01 +0100] info [webmaild] 197.184.80.124 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-27 07:13:37 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:20243: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-27 07:13:22 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:38612: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.119.68
description:
2025-01-27 07:13:25 dovecot_plain authenticator failed for p72069-obmd01.osaka.ocn.ne.jp [180.7.119.68]:37569: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.28.137.26
description:
2025-01-27 07:13:33 dovecot_plain authenticator failed for ([112.28.137.26]) [112.28.137.26]:48390: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.208.177.56
description:
Jan 27 07:12:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.208.177.56 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.172.215.89
description:
[2025-01-27 07:13:18 +0100] info [webmaild] 187.172.215.89 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.28.137.26
description:
Jan 27 07:13:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.28.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.33.109.90
description:
2025-01-27 07:14:25 dovecot_plain authenticator failed for (90.109.33.58.broad.xw.sh.dynamic.163data.com.cn) [58.33.109.90]:39972: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
description:
2025-01-27 07:13:46 dovecot_plain authenticator failed for ([220.180.107.193]) [220.180.107.193]:34960: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 27 07:13:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-27 07:13:59 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:1875: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.103.248.120
description:
Jan 27 07:14:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.103.248.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.103.248.120
description:
2025-01-27 07:14:03 dovecot_plain authenticator failed for ([91.103.248.120]) [91.103.248.120]:41763: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.87.49.250
description:
2025-01-27 07:14:17 dovecot_plain authenticator failed for ([222.87.49.250]) [222.87.49.250]:55921: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.33.109.90
description:
Jan 27 07:14:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.33.109.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 27 07:13:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-27 07:13:56 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:44752: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.87.49.250
description:
Jan 27 07:14:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.87.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-01-27 07:14:35 dovecot_plain authenticator failed for (089-101-036159.ntlworld.ie) [89.101.36.159]:55695: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
description:
Jan 27 07:14:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
description:
2025-01-27 07:15:06 dovecot_plain authenticator failed for nova-185-040-122-250.cpe.novanet.is [185.40.122.250]:49754: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.142.39.13
description:
Jan 27 07:15:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.142.39.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-27 07:15:04 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:56111: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.142.39.13
description:
2025-01-27 07:15:11 dovecot_plain authenticator failed for ([125.142.39.13]) [125.142.39.13]:35733: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-01-27 07:15:16 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:58568: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 27 07:15:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Jan 27 07:15:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:14:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
description:
2025-01-27 07:14:58 dovecot_plain authenticator failed for ([183.134.209.86]) [183.134.209.86]:38308: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.225.68.108
description:
2025-01-27 07:15:02 dovecot_plain authenticator failed for 90-225-68-108-no2666.tbcn.telia.com [90.225.68.108]:44772: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.225.68.108
description:
Jan 27 07:15:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.225.68.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.92.86.18
description:
Jan 27 07:15:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.92.86.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.92.86.18
description:
2025-01-27 07:15:14 dovecot_plain authenticator failed for (static-14.38.103.extranet.co.in) [111.92.86.18]:50852: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-27 07:15:15 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:43043: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
description:
2025-01-27 07:14:55 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:48220: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 27 07:14:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-27 07:14:58 dovecot_plain authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:57090: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.201.45
description:
2025-01-27 07:16:16 dovecot_plain authenticator failed for (45.201.33.36.adsl-pool.ah.cnuninet.net) [36.33.201.45]:40684: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.41.197.10
description:
2025-01-27 07:16:39 dovecot_plain authenticator failed for ([59.41.197.10]) [59.41.197.10]:57171: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-27 07:15:46 dovecot_plain authenticator failed for (piers) [164.92.243.206]:43876: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 07:15:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.190.111.104
description:
Jan 27 07:16:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.190.111.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 27 07:16:06 ait sshd[2716548]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 07:16:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 27 07:15:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.91.176.243
description:
Jan 27 07:16:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.91.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 27 07:16:06 ait sshd[2716548]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.91.176.243
description:
2025-01-27 07:16:36 dovecot_plain authenticator failed for ([118.91.176.243]) [118.91.176.243]:32770: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-27 07:16:37 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:36042: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.190.111.104
description:
2025-01-27 07:16:06 dovecot_plain authenticator failed for 107-190-111-104.cpe.teksavvy.com [107.190.111.104]:33926: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.201.45
description:
Jan 27 07:16:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-27 07:17:43 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:52678: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.253.87
description:
2025-01-27 07:16:46 dovecot_plain authenticator failed for (chents) [185.254.253.87]:34788: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.253.87
description:
Jan 27 07:16:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.253.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-27 07:16:48 dovecot_plain authenticator failed for ([203.252.10.5]) [203.252.10.3]:52401: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.185.89.241
description:
2025-01-27 07:16:57 dovecot_plain authenticator failed for ([39.185.89.241]) [39.185.89.241]:43760: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
description:
Jan 27 07:16:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-27 07:17:16 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:59964: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
description:
Jan 27 07:16:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
description:
2025-01-27 07:16:46 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:56302: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
description:
2025-01-27 07:16:48 dovecot_plain authenticator failed for (videoifolder.ru) [78.108.186.10]:33952: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.185.89.241
description:
Jan 27 07:16:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.185.89.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 27 07:17:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 27 07:17:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 27 07:16:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.233.219.34
description:
Jan 27 07:17:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.233.219.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-01-27 07:17:59 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:46388: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.120.67.149
description:
2025-01-27 07:18:07 dovecot_plain authenticator failed for ([87.120.67.149]) [87.120.67.149]:39949: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.72.99
description:
Jan 27 07:18:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.72.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-27 07:17:46 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:42666: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.72.99
description:
2025-01-27 07:18:31 dovecot_plain authenticator failed for ([152.52.72.99]) [152.52.72.99]:49511: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Jan 27 07:17:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.219.34
description:
2025-01-27 07:17:58 dovecot_plain authenticator failed for ([186.233.219.34]) [186.233.219.34]:46690: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-18.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 27 07:17:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
description:
2025-01-27 07:17:58 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:58064: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.120.67.149
description:
Jan 27 07:18:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.120.67.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.154.94.85
description:
2025-01-27 07:18:42 dovecot_plain authenticator failed for ([43.154.94.85]) [43.154.94.85]:40660: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.212.105.34
description:
Jan 27 07:18:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.212.105.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.212.105.34
description:
2025-01-27 07:18:53 dovecot_plain authenticator failed for ([102.212.105.34]) [102.212.105.34]:37452: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Jan 27 07:19:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-01-27 07:19:18 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:40671: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.184
description:
2025-01-27 07:19:30 dovecot_plain authenticator failed for ([171.244.60.184]) [171.244.60.184]:31876: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 27 07:19:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 07:18:49 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (cantrilly) [51.255.84.180]:40092: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
description:
2025-01-27 07:19:06 dovecot_plain authenticator failed for (factomop) [65.20.162.187]:37955: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 27 07:20:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-27 07:20:38 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:32910: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.30.115
description:
Jan 27 07:19:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.30.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 27 07:20:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-27 07:20:29 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:56330: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 27 07:20:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.30.115
description:
2025-01-27 07:19:57 dovecot_plain authenticator failed for ([5.31.30.115]) [5.31.30.115]:55042: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Jan 27 07:20:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-01-27 07:20:41 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:37380: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
description:
2025-01-27 07:20:10 dovecot_plain authenticator failed for syn-075-080-065-214.biz.spectrum.com [75.80.65.214]:45432: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 07:20:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 07:20:27 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:53464: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 27 07:20:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.13
description:
2025-01-27 07:20:32 dovecot_login authenticator failed for 013.143.48.116.static.netvigator.com [116.48.143.13]:61013: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-27 07:20:19 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:51906: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-27 07:20:51 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:37887: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-27 07:20:57 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:47041: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 27 07:21:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 27 07:21:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Jan 27 07:20:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-27 07:21:43 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:58792: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 07:21:33 ait sshd[2719295]: Invalid user ewert-werbung.com 2a00 from 122.51.104.242 port 45144


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 27 07:20:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.63.225.184
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-20.178.63.225.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.98.202
description:
2025-01-27 07:20:58 dovecot_plain authenticator failed for ([223.71.98.202]) [223.71.98.202]:43500: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 27 07:21:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.184.86.186
description:
Jan 27 07:21:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.184.86.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.29.53
description:
2025-01-27 07:21:18 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:44082: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-27 07:20:59 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:10829: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-27 07:21:02 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:36085: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 165.227.206.247
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:07-21.165.227.206.247


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-27 07:21:06 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:15451: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 27 07:20:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.164
description:
2025-01-27 07:21:10 dovecot_plain authenticator failed for (fratedic) [65.20.204.164]:47058: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 07:21:15 ait sshd[2719189]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
description:
Jan 27 07:21:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 07:21:33 ait sshd[2719295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-01-27 07:20:44 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:56777: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.204.164
description:
Jan 27 07:21:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.204.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.184.86.186
description:
2025-01-27 07:21:09 dovecot_plain authenticator failed for ([222.184.86.186]) [222.184.86.186]:36852: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 07:21:15 ait sshd[2719189]: Invalid user musikschule-deuerling.de 2a01 from 111.231.56.128 port 50088


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 07:21:15 ait sshd[2719189]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-27 07:21:43 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:56795: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Jan 27 07:22:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 07:21:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.32.45.10
description:
2025-01-27 07:21:58 dovecot_plain authenticator failed for ([125.32.45.10]) [125.32.45.10]:60748: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 07:22:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-27 07:22:06 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:44098: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-27 07:22:34 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:49502: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.35.242.51
description:
Jan 27 07:21:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.35.242.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.32.45.10
description:
Jan 27 07:21:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.32.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-27 07:22:19 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:35479: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 27 07:22:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 27 07:21:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-27 07:21:59 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:45498: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 27 07:22:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-01-27 07:22:42 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:43250: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 07:21:54 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:49126: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.35.242.51
description:
2025-01-27 07:21:57 dovecot_plain authenticator failed for host-79-35-242-51.retail.telecomitalia.it [79.35.242.51]:43900: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.109.33.120
description:
Jan 27 07:23:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.109.33.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Jan 27 07:23:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-01-27 07:23:21 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:58586: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-27 07:23:31 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:59540: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.165.172.38
description:
Jan 27 07:23:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.165.172.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 27 07:22:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-27 07:22:49 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:58094: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.223.168.193
description:
2025-01-27 07:22:56 dovecot_plain authenticator failed for c-98-223-168-193.hsd1.il.comcast.net [98.223.168.193]:65051: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.109.33.120
description:
2025-01-27 07:23:09 dovecot_plain authenticator failed for rplus.dp.ua [77.109.33.120]:52458: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.147.2.19
description:
[2025-01-27 07:23:11 +0100] info [webmaild] 41.147.2.19 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 27 07:23:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-27 07:24:16 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:37610: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.97
description:
Jan 27 07:24:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.195
description:
2025-01-27 07:24:31 dovecot_plain authenticator failed for (parle) [65.20.160.195]:43314: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.66
description:
2025-01-27 07:24:32 dovecot_login authenticator failed for ([193.32.162.66]) [193.32.162.66]:57852: 535 Incorrect authentication data (set_id=backup)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-24.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 07:24:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
description:
2025-01-27 07:24:23 dovecot_login authenticator failed for ([158.140.38.21]) [158.140.38.21]:53830: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 27 07:24:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.159
description:
2025-01-27 07:24:27 dovecot_plain authenticator failed for (poecres) [65.20.143.159]:37710: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.195
description:
Jan 27 07:24:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.73
description:
Jan 27 07:24:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.81
description:
Jan 27 07:24:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Jan 27 07:24:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
description:
2025-01-27 07:24:11 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:48774: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.143.159
description:
Jan 27 07:24:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.143.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.97
description:
2025-01-27 07:24:28 dovecot_login authenticator failed for ([193.32.162.97]) [193.32.162.97]:56085: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-27 07:24:29 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:58028: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.73
description:
2025-01-27 07:24:45 dovecot_login authenticator failed for ([193.32.162.73]) [193.32.162.73]:49455: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.83
description:
2025-01-27 07:24:52 dovecot_login authenticator failed for ([193.32.162.83]) [193.32.162.83]:51573: 535 Incorrect authentication data (set_id=aa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
description:
Jan 27 07:24:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-01-27 07:24:09 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:34089: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 27 07:24:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
description:
Jan 27 07:24:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.66
description:
Jan 27 07:24:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.83
description:
Jan 27 07:24:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.32.162.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.32.162.81
description:
2025-01-27 07:25:00 dovecot_login authenticator failed for ([193.32.162.81]) [193.32.162.81]:63572: 535 Incorrect authentication data (set_id=fax)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 27 07:25:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-27 07:25:10 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (tomors) [62.63.230.241]:34146: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.180.113.155
description:
Jan 27 07:25:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.180.113.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.180.113.155
description:
2025-01-27 07:25:17 dovecot_plain authenticator failed for syn-072-180-113-155.res.spectrum.com [72.180.113.155]:56716: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 27 07:25:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-27 07:25:26 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:34383: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.138
description:
2025-01-27 07:26:27 dovecot_plain authenticator failed for ([112.91.124.138]) [112.91.124.138]:46883: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.156
description:
Jan 27 07:26:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-01-27 07:26:46 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:55160: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Jan 27 07:26:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.138
description:
Jan 27 07:26:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Jan 27 07:26:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.156
description:
2025-01-27 07:26:33 dovecot_login authenticator failed for (nsg-corporate-156.229.187.122.airtel.in) [122.187.229.156]:39695: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 27 07:26:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 07:26:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-01-27 07:26:16 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:39425: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 07:26:38 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (macresde) [51.255.84.180]:50550: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-27 07:26:38 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:41853: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-01-27 07:26:28 dovecot_plain authenticator failed for ([106.51.92.248]) [106.51.92.248]:35472: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Jan 27 07:26:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.168.134.188
description:
[2025-01-27 07:27:08 +0100] info [webmaild] 105.168.134.188 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.225.53.149
description:
2025-01-27 07:27:22 dovecot_plain authenticator failed for ([173.225.53.149]) [173.225.53.149]:60508: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 27 07:27:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.225.53.149
description:
Jan 27 07:27:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.225.53.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.164.176.167
description:
Jan 27 07:27:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.164.176.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.164.176.167
description:
2025-01-27 07:27:30 dovecot_plain authenticator failed for ([95.164.176.167]) [95.164.176.167]:35486: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 07:27:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 27 07:27:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-27 07:27:46 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:45179: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-27 07:27:05 dovecot_login authenticator failed for (170.250.152.88.hwccustomers.com) [170.250.152.88]:52490: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-27 07:27:18 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:34924: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.176.186.20
description:
[2025-01-27 07:27:47 +0100] info [webmaild] 196.176.186.20 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:27:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 27 07:27:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.202.206.163
description:
Jan 27 07:28:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.202.206.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 27 07:28:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.30.20.5
description:
[2025-01-27 07:28:38 +0100] info [webmaild] 5.30.20.5 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 07:28:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Jan 27 07:28:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
description:
2025-01-27 07:28:23 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:60891: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.202.206.163
description:
2025-01-27 07:28:26 dovecot_plain authenticator failed for 163.189-202-206.bestelclientes.com.mx [189.202.206.163]:37338: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-27 07:28:27 dovecot_plain authenticator failed for (unbermams) [109.108.95.66]:56732: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.166.78
description:
2025-01-27 07:28:38 dovecot_plain authenticator failed for (223-197-166-78.static.imsbiz.com) [223.197.166.78]:59906: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 27 07:28:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 07:28:49 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:50946: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.178.21.162
description:
2025-01-27 07:28:09 dovecot_login authenticator failed for ([123.178.21.162]) [123.178.21.162]:42860: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
description:
Jan 27 07:28:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 27 07:28:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.166.78
description:
Jan 27 07:28:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.166.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-27 07:28:49 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (coudaha) [109.67.154.24]:63084: 535 Incorrect authentication data (set_id=eng20a00105y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.178.21.162
description:
Jan 27 07:28:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.178.21.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.38.211.155
description:
2025-01-27 07:28:07 dovecot_plain authenticator failed for p383156-obmd01.tokyo.ocn.ne.jp [60.38.211.155]:42701: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 07:28:21 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:48070: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-27 07:28:31 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:60252: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
description:
2025-01-27 07:29:01 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:49733: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-27 07:29:03 dovecot_login authenticator failed for ([119.200.229.33]) [119.200.229.33]:58421: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 27 07:29:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 27 07:29:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 07:29:43 ait sshd[2723907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
description:
Jan 27 07:28:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 27 07:29:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-27 07:29:03 dovecot_plain authenticator failed for 9498.telnet.bg (micattes) [87.254.165.100]:48810: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 27 07:29:43 ait sshd[2723907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.45.175.126
description:
[2025-01-27 07:29:04 +0100] info [webmaild] 177.45.175.126 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-27 07:29:16 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:44192: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.205.222
description:
2025-01-27 07:30:14 dovecot_login authenticator failed for (m121-202-205-222.smartone.com) [121.202.205.222]:25691: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-27 07:30:19 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:36866: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-27 07:30:24 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:50308: 535 Incorrect authentication data (set_id=sales@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-01-27 07:30:37 dovecot_plain authenticator failed for net-2-36-64-247.cust.vodafonedsl.it (agulvers) [2.36.64.247]:47760: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-27 07:30:59 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:55367: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-30.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 27 07:30:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.205.222
description:
Jan 27 07:30:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.205.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Jan 27 07:30:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-27 07:30:37 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:13754: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 27 07:30:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
description:
Jan 27 07:30:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 27 07:30:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-27 07:30:08 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:32146: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.120.93
description:
[2025-01-27 07:30:21 +0100] info [webmaild] 157.100.120.93 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.224.22.135
description:
2025-01-27 07:30:00 dovecot_login authenticator failed for ([50.224.22.135]) [50.224.22.135]:42115: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-27 07:30:05 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:20030: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 27 07:30:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.67
description:
2025-01-27 07:30:24 dovecot_login authenticator failed for ([111.61.176.67]) [111.61.176.67]:32180: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 27 07:30:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.83.165
description:
[2025-01-27 07:30:55 +0100] info [webmaild] 170.150.83.165 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 27 07:30:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.224.22.135
description:
Jan 27 07:29:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.224.22.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 27 07:30:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 27 07:31:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-27 07:31:00 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:18852: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 27 07:31:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-27 07:31:11 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:37597: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Jan 27 07:31:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-01-27 07:31:23 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:35970: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.120.97
description:
Jan 27 07:31:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.120.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.35.196
description:
Jan 27 07:31:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.35.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.107.78.242
description:
[2025-01-27 07:31:04 +0100] info [webmaild] 103.107.78.242 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 27 07:31:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-27 07:31:10 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:49289: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.120.97
description:
2025-01-27 07:31:35 dovecot_plain authenticator failed for v2202501250131308547.bestsrv.de [152.53.120.97]:48350: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 70.45.202.114
description:
[2025-01-27 07:32:25 +0100] info [webmaild] 70.45.202.114 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.175.242
description:
Jan 27 07:32:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.175.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.242
description:
2025-01-27 07:32:34 dovecot_plain authenticator failed for (ancost) [65.20.175.242]:46386: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 27 07:31:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.73.174
description:
[2025-01-27 07:32:22 +0100] info [webmaild] 169.224.73.174 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.211.36.7
description:
[2025-01-27 07:32:23 +0100] info [webmaild] 179.211.36.7 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 27 07:32:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-01-27 07:33:53 dovecot_login authenticator failed for ([223.241.100.90]) [223.241.100.90]:60709: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 27 07:33:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-01-27 07:33:38 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:35146: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Jan 27 07:33:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-27 07:33:00 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:55356: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 27 07:33:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-27 07:33:24 dovecot_plain authenticator failed for (bienes) [154.144.243.93]:48214: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-27 07:33:35 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:38550: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Jan 27 07:33:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.175.242
description:
Jan 27 07:33:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.175.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.242
description:
2025-01-27 07:33:51 dovecot_plain authenticator failed for (diums) [65.20.175.242]:49224: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 27 07:34:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-27 07:34:36 dovecot_login authenticator failed for ([222.160.227.134]) [222.160.227.134]:42856: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.124.54.14
description:
Jan 27 07:34:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.124.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.124.54.14
description:
2025-01-27 07:34:49 dovecot_login authenticator failed for ([103.124.54.14]) [103.124.54.14]:34540: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-27 07:35:51 dovecot_plain authenticator failed for ([116.114.84.242]) [116.114.84.242]:53542: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 07:35:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 27 07:35:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-27 07:35:47 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:59401: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.252.96
description:
Jan 27 07:35:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.252.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 27 07:35:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-27 07:35:55 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:43454: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.95.225.202
description:
Jan 27 07:35:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.95.225.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.95.225.202
description:
2025-01-27 07:35:25 dovecot_plain authenticator failed for ([23.95.225.202]) [23.95.225.202]:42120: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 27 07:35:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 27 07:35:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 27 07:35:45 ait sshd[2727456]: Invalid user universitypublishing from 175.126.195.176 port 50193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Jan 27 07:35:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.52.107
description:
Jan 27 07:35:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.52.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
description:
2025-01-27 07:35:18 dovecot_plain authenticator failed for ([112.196.52.107]) [112.196.52.107]:34630: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 07:35:24 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:40758: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:35:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.252.96
description:
2025-01-27 07:35:51 dovecot_plain authenticator failed for p96096-obmd01.tokyo.ocn.ne.jp [124.101.252.96]:46803: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-01-27 07:35:53 dovecot_login authenticator failed for (57.252.223.60.adsl-pool.sx.cn) [60.223.252.57]:37490: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.68.226.171
description:
Jan 27 07:35:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.68.226.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 07:35:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 07:35:35 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (retia) [51.255.84.180]:48460: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-27 07:35:37 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:53097: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 27 07:35:45 ait sshd[2727456]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 27 07:36:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.87.152.13
description:
[2025-01-27 07:36:39 +0100] info [webmaild] 213.87.152.13 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.0.199.165
description:
2025-01-27 07:36:04 dovecot_plain authenticator failed for 14-0-199-165.static.pccw-hkt.com [14.0.199.165]:47822: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.148.186.186
description:
Jan 27 07:36:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.148.186.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-27 07:36:08 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:45892: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-27 07:36:36 dovecot_login authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net [108.18.206.153]:53509: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-27 07:36:43 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:42650: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
description:
2025-01-27 07:36:00 dovecot_plain authenticator failed for vps-b674cd8d.vps.ovh.net [51.68.226.171]:35602: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 27 07:36:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.111.157.85
description:
[2025-01-27 07:36:05 +0100] info [webmaild] 187.111.157.85 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.148.186.186
description:
2025-01-27 07:36:11 dovecot_plain authenticator failed for ([116.148.186.186]) [116.148.186.186]:42378: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.31.174.3
description:
Jan 27 07:36:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.31.174.3 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-36.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 07:36:49 ait sshd[2728032]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.0.199.165
description:
Jan 27 07:36:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.0.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 27 07:36:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 27 07:36:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 07:36:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.165.114
description:
2025-01-27 07:36:05 dovecot_plain authenticator failed for (static.ill.117.250.165.114.bsnl.co.in) [117.250.165.114]:50984: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.201.62.71
description:
Jan 27 07:36:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.201.62.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.165.114
description:
Jan 27 07:36:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 27 07:36:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 27 07:36:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.40.142.57
description:
2025-01-27 07:36:41 dovecot_plain authenticator failed for (overm) [102.40.142.57]:59606: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-27 07:36:45 dovecot_plain authenticator failed for (stord) [102.53.15.54]:42298: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.59.106
description:
2025-01-27 07:36:10 dovecot_plain authenticator failed for ([121.128.76.109]) [61.72.59.106]:60680: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-27 07:36:14 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:35634: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 27 07:36:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
description:
Jan 27 07:36:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 27 07:36:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 07:36:48 ait sshd[2728032]: Invalid user envergure224.com 2a00 from 111.231.56.128 port 53852


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-27 07:36:23 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:36837: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.201.62.71
description:
2025-01-27 07:36:25 dovecot_login authenticator failed for ([218.201.62.71]) [218.201.62.71]:41512: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-27 07:37:56 dovecot_plain authenticator failed for ([8.20.22.58]) [8.20.22.58]:58875: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-27 07:37:56 dovecot_login authenticator failed for net-93-149-50-114.cust.vodafonedsl.it [93.149.50.114]:33822: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.89.64.47
description:
Jan 27 07:37:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.89.64.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.180.129.87
description:
Jan 27 07:37:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.180.129.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.89.64.47
description:
2025-01-27 07:37:51 dovecot_plain authenticator failed for fe938964-c47.eso-es.net [93.89.64.47]:60996: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 27 07:37:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 27 07:37:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
description:
2025-01-27 07:37:20 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:59975: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.233.219.34
description:
Jan 27 07:37:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.233.219.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.219.34
description:
2025-01-27 07:37:58 dovecot_plain authenticator failed for ([186.233.219.34]) [186.233.219.34]:43478: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
description:
2025-01-27 07:37:08 dovecot_plain authenticator failed for ([121.202.200.120]) [121.202.200.120]:6786: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
description:
Jan 27 07:37:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.180.129.87
description:
2025-01-27 07:37:35 dovecot_plain authenticator failed for (175-180-129-87.adsl.dynamic.seed.net.tw) [175.180.129.87]:57636: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
description:
Jan 27 07:37:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
description:
2025-01-27 07:38:21 dovecot_plain authenticator failed for ([60.214.127.246]) [60.214.127.246]:27603: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 27 07:38:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.223
description:
2025-01-27 07:38:34 dovecot_login authenticator failed for ([93.182.160.223]) [93.182.160.223]:41416: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 27 07:38:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.93.159
description:
2025-01-27 07:38:08 dovecot_plain authenticator failed for ([114.250.93.159]) [114.250.93.159]:53612: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.79.232.38
description:
2025-01-27 07:38:13 dovecot_plain authenticator failed for ([142.79.232.38]) [142.79.232.38]:50693: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
description:
Jan 27 07:38:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-27 07:38:40 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:30766: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.202.224
description:
Jan 27 07:38:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.202.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.79.232.38
description:
Jan 27 07:38:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.79.232.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.202.224
description:
2025-01-27 07:38:10 dovecot_plain authenticator failed for ([196.46.202.224]) [196.46.202.224]:41231: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
description:
2025-01-27 07:38:18 dovecot_login authenticator failed for ([111.61.177.3]) [111.61.177.3]:55140: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-27 07:38:27 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:60856: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.223
description:
Jan 27 07:38:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 27 07:38:43 ait sshd[2728998]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.93.159
description:
Jan 27 07:38:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.93.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 27 07:38:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-27 07:38:24 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:41936: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 27 07:38:43 ait sshd[2728998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
description:
Jan 27 07:38:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 27 07:39:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-27 07:39:13 dovecot_login authenticator failed for ([46.52.204.227]) [46.52.204.227]:49716: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-27 07:39:17 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:49910: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 27 07:39:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 27 07:39:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 27 07:39:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-27 07:39:05 dovecot_login authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:63072: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.225.136.75
description:
[2025-01-27 07:39:06 +0100] info [webmaild] 200.225.136.75 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 27 07:39:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-01-27 07:39:25 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:46416: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-27 07:39:25 dovecot_plain authenticator failed for (mantrang) [102.53.15.54]:46979: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-27 07:40:38 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:59610: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-27 07:40:55 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:57686: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.225.169
description:
Jan 27 07:40:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.225.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 27 07:40:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:40:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.253.15
description:
[2025-01-27 07:40:44 +0100] info [webmaild] 143.255.253.15 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-27 07:40:18 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:59088: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.30.141.222
description:
Jan 27 07:40:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.30.141.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
description:
2025-01-27 07:40:35 dovecot_login authenticator failed for (5x167x48x130.dynamic.rostov.ertelecom.ru) [5.167.48.130]:60123: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-27 07:40:02 dovecot_plain authenticator failed for (emizably) [109.160.123.6]:38598: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 27 07:40:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.30.141.222
description:
2025-01-27 07:40:29 dovecot_login authenticator failed for ([58.30.141.222]) [58.30.141.222]:57784: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 27 07:40:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.225.169
description:
2025-01-27 07:40:17 dovecot_login authenticator failed for net-2-37-225-169.cust.vodafonedsl.it [2.37.225.169]:57111: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
description:
Jan 27 07:40:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 27 07:40:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.160.123.6
description:
Jan 27 07:40:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.160.123.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-27 07:40:07 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:49464: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 07:40:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 07:40:15 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:53624: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.235
description:
2025-01-27 07:41:49 dovecot_plain authenticator failed for (arthewing) [65.20.168.235]:50952: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Jan 27 07:41:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.40.142.57
description:
2025-01-27 07:41:54 dovecot_plain authenticator failed for (resilikey) [102.40.142.57]:56876: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-27 07:41:25 dovecot_plain authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:61380: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
description:
Jan 27 07:41:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.60
description:
47.128.52.60 - - [27/Jan/2025:07:41:51 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=32053339 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/?filter_course-language=121&filtering=1&price_type=free" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-01-27 07:41:52 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net (coutinigri) [77.157.174.51]:46085: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.150.27.132
description:
Jan 27 07:41:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.150.27.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 27 07:41:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.103.231.87
description:
Jan 27 07:41:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.103.231.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.103.231.87
description:
2025-01-27 07:41:42 dovecot_login authenticator failed for ([59.103.231.87]) [59.103.231.87]:62481: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.235
description:
Jan 27 07:41:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.219.104.210
description:
2025-01-27 07:41:51 dovecot_login authenticator failed for net-188-219-104-210.cust.vodafonedsl.it [188.219.104.210]:40511: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.27.132
description:
2025-01-27 07:41:57 dovecot_plain authenticator failed for c188-150-27-132.bredband.tele2.se (renlea) [188.150.27.132]:59670: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 07:41:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.53
description:
Jan 27 07:41:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.53
description:
2025-01-27 07:41:16 dovecot_plain authenticator failed for ([102.69.163.53]) [102.69.163.53]:44643: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-27 07:42:02 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:60586: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-27 07:42:14 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:52693: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 27 07:42:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-27 07:42:40 dovecot_plain authenticator failed for (mintious) [62.231.31.86]:36023: 535 Incorrect authentication data (set_id=eng17b00218y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.232.37.90
description:
2025-01-27 07:42:27 dovecot_plain authenticator failed for (tarabled) [185.232.37.90]:39890: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Jan 27 07:42:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-01-27 07:42:37 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:41312: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 27 07:42:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 27 07:42:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-42.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-27 07:42:41 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:52690: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 27 07:42:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 27 07:42:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-27 07:42:15 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:44596: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.232.37.90
description:
Jan 27 07:42:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.232.37.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-27 07:42:28 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:47728: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 27 07:42:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.221.56
description:
Jan 27 07:43:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.221.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.234
description:
2025-01-27 07:43:36 dovecot_plain authenticator failed for (aulus) [65.20.169.234]:37323: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.77.136
description:
Jan 27 07:43:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.77.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-27 07:43:51 dovecot_plain authenticator failed for (homaze) [77.239.255.163]:33928: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.88.104
description:
2025-01-27 07:43:35 dovecot_login authenticator failed for ([1.235.88.104]) [1.235.88.104]:39289: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 27 07:43:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-27 07:43:22 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:40878: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.234
description:
Jan 27 07:43:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.88.234
description:
2025-01-27 07:43:35 dovecot_plain authenticator failed for ([188.59.88.234]) [188.59.88.234]:45250: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.221.56
description:
2025-01-27 07:43:37 dovecot_plain authenticator failed for ([183.236.221.56]) [183.236.221.56]:36648: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.235.88.104
description:
Jan 27 07:43:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.235.88.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.88.234
description:
Jan 27 07:43:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.88.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.77.136
description:
2025-01-27 07:43:43 dovecot_plain authenticator failed for ([80.233.77.136]) [80.233.77.136]:61861: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.81.70.80
description:
Jan 27 07:43:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.81.70.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.81.70.80
description:
2025-01-27 07:43:46 dovecot_plain authenticator failed for (50-81-70-80.client.mchsi.com) [50.81.70.80]:38998: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 27 07:43:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-27 07:44:02 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:47206: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 27 07:44:12 ait sshd[2731952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.235.100.6
description:
2025-01-27 07:44:13 dovecot_plain authenticator failed for host-105-235-100-6.afnet.net [105.235.100.6]:50979: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 27 07:44:12 ait sshd[2731952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 27 07:44:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-27 07:44:22 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:37900: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-01-27 07:44:28 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:58966: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 27 07:44:54 ait sshd[2732308]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 27 07:44:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 27 07:44:54 ait sshd[2732308]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.53.152.38
description:
2025-01-27 07:44:03 dovecot_plain authenticator failed for ([71.53.152.38]) [71.53.152.38]:40277: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.235.100.6
description:
Jan 27 07:44:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.235.100.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Jan 27 07:44:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.138.130.17
description:
Jan 27 07:44:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.138.130.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.138.130.17
description:
2025-01-27 07:44:41 dovecot_plain authenticator failed for p578a8211.dip0.t-ipconnect.de (degiopting) [87.138.130.17]:47551: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.75.215.245
description:
Jan 27 07:45:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.75.215.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
description:
2025-01-27 07:45:30 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:35556: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
description:
2025-01-27 07:45:42 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:52799: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.250.238.189
description:
2025-01-27 07:45:03 dovecot_plain authenticator failed for c83-250-238-189.bredband.tele2.se (nopoter) [83.250.238.189]:34132: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-27 07:45:18 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:51726: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.126
description:
Jan 27 07:45:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.250.238.189
description:
Jan 27 07:45:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.250.238.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Jan 27 07:45:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.4.195.146
description:
Jan 27 07:45:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.4.195.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.4.195.146
description:
2025-01-27 07:45:49 dovecot_plain authenticator failed for (ip146.ip-142-4-195.net) [142.4.195.146]:36628: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.126
description:
2025-01-27 07:45:57 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:54193: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 27 07:45:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.182.64.203
description:
Jan 27 07:45:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.182.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.182.64.203
description:
2025-01-27 07:45:54 dovecot_login authenticator failed for (175-182-64-203.adsl.dynamic.seed.net.tw) [175.182.64.203]:47206: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Jan 27 07:46:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-27 07:46:07 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:57228: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 27 07:46:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-01-27 07:46:47 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:56166: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.146.233.123
description:
2025-01-27 07:47:00 dovecot_plain authenticator failed for ([103.146.233.123]) [103.146.233.123]:58902: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.14.36.47
description:
Jan 27 07:46:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.14.36.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
description:
Jan 27 07:46:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-27 07:46:45 dovecot_plain authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:50462: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
description:
2025-01-27 07:46:57 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:36816: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.253.175
description:
Jan 27 07:46:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.131.97.138
description:
Jan 27 07:46:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.131.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
description:
Jan 27 07:46:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-27 07:46:45 dovecot_login authenticator failed for ([103.109.44.163]) [103.109.44.163]:49942: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.131.97.138
description:
2025-01-27 07:46:50 dovecot_login authenticator failed for ([117.131.97.138]) [117.131.97.138]:60788: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-01-27 07:46:10 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:53180: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 27 07:46:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.19.176
description:
2025-01-27 07:46:35 dovecot_login authenticator failed for (static.ip.81.22.19.176.kalaam-telecom.com) [81.22.19.176]:36131: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
description:
2025-01-27 07:46:35 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:39260: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.218.28.118
description:
2025-01-27 07:46:06 dovecot_login authenticator failed for (cpe-c83a353b2048.cpe.cableonda.net) [190.218.28.118]:59718: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 27 07:46:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Jan 27 07:46:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.44.120
description:
47.128.44.120 - - [27/Jan/2025:07:46:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=31239600 HTTP/1.1" 302 0 lemass.net "http://lemass.net/AITIS/2020/01/09/Log.php" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.44.120


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
description:
Jan 27 07:46:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.14.36.47
description:
2025-01-27 07:46:45 dovecot_plain authenticator failed for ([60.14.36.47]) [60.14.36.47]:58235: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
description:
2025-01-27 07:46:59 dovecot_login authenticator failed for ([112.194.143.206]) [112.194.143.206]:46300: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.218.28.118
description:
Jan 27 07:46:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.218.28.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.253.175
description:
2025-01-27 07:46:17 dovecot_login authenticator failed for ([90.188.253.175]) [90.188.253.175]:46089: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 27 07:46:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-27 07:46:23 dovecot_plain authenticator failed for ([203.177.65.26]) [58.69.17.18]:47670: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.22.19.176
description:
Jan 27 07:46:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.22.19.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.146.233.123
description:
Jan 27 07:46:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.146.233.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.27.247.25
description:
Jan 27 07:47:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.27.247.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.27.247.25
description:
2025-01-27 07:47:10 dovecot_plain authenticator failed for ([92.27.247.25]) [92.27.247.25]:36163: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.213
description:
2025-01-27 07:47:46 dovecot_login authenticator failed for ([195.178.110.213]) [195.178.110.213]:55864: 535 Incorrect authentication data (set_id=test1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 27 07:47:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
description:
Jan 27 07:47:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 07:47:03 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (hinecaters) [51.255.84.180]:50644: 535 Incorrect authentication data (set_id=ads19b00191y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
description:
2025-01-27 07:47:05 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:52306: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 79.117.113.43
description:
Jan 27 07:47:31 ait sshd[2733738]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.117.113.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.213
description:
Jan 27 07:47:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.90.117.84
description:
Jan 27 07:47:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.90.117.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.119.124.66
description:
Jan 27 07:47:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.119.124.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 07:47:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.90.117.84
description:
2025-01-27 07:47:51 dovecot_plain authenticator failed for ([165.90.117.84]) [165.90.117.84]:38720: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-27 07:47:59 dovecot_plain authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:35152: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.119.124.66
description:
2025-01-27 07:47:02 dovecot_plain authenticator failed for ([222.119.124.66]) [222.119.124.66]:54391: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.117.113.43
description:
Jan 27 07:47:31 ait sshd[2733738]: pam_imunify(sshd:auth): [IM360_RBL] The IP 79.117.113.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.180.130.157
description:
Jan 27 07:48:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.180.130.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.180.130.157
description:
2025-01-27 07:48:57 dovecot_plain authenticator failed for ([182.180.130.157]) [182.180.130.157]:51112: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
description:
Jan 27 07:48:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.81.140.83
description:
Jan 27 07:48:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.81.140.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-01-27 07:48:31 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:57257: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 27 07:48:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-27 07:48:56 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.138]:56234: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-27 07:48:12 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:55766: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.62.88.173
description:
[2025-01-27 07:48:18 +0100] info [webmaild] 190.62.88.173 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
description:
2025-01-27 07:48:20 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:20137: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.182.83.231
description:
Jan 27 07:48:24 ait sshd[2734089]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.182.83.231


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
description:
2025-01-27 07:48:02 dovecot_plain authenticator failed for ([60.216.37.11]) [60.216.37.11]:34064: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Jan 27 07:48:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
description:
Jan 27 07:48:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.182.83.231
description:
Jan 27 07:48:24 ait sshd[2734089]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.182.83.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Jan 27 07:48:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.216.72
description:
Jan 27 07:48:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.216.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-01-27 07:48:19 dovecot_plain authenticator failed for net-130-0-149-238.cust.vodafonedsl.it (pheaes) [130.0.149.238]:51430: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.71.121.54
description:
2025-01-27 07:48:21 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:45083: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-27 07:48:23 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:36868: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Jan 27 07:48:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.229
description:
Jan 27 07:48:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.229
description:
2025-01-27 07:48:09 dovecot_login authenticator failed for ([104.241.229.229]) [104.241.229.229]:44166: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.71.121.54
description:
Jan 27 07:48:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.71.121.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 27 07:48:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.81.140.83
description:
2025-01-27 07:48:14 dovecot_plain authenticator failed for ([42.81.140.83]) [42.81.140.83]:43838: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 27 07:48:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.117.113.43
description:
Jan 27 07:49:29 ait sshd[2734812]: pam_imunify(sshd:auth): [IM360_RBL] The IP 79.117.113.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
description:
Jan 27 07:49:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 27 07:49:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.147.98.39
description:
2025-01-27 07:49:26 dovecot_plain authenticator failed for ([203.147.98.39]) [203.147.98.39]:55952: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.202.224
description:
Jan 27 07:49:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.202.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
description:
2025-01-27 07:49:27 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:47917: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.109.20.192
description:
Jan 27 07:49:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.109.20.192 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 79.117.113.43
description:
Jan 27 07:49:29 ait sshd[2734812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.117.113.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.124.119.7
description:
Jan 27 07:49:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.124.119.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.71.37.202
description:
2025-01-27 07:49:38 dovecot_plain authenticator failed for ([47.98.191.121]) [101.71.37.202]:37456: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
description:
2025-01-27 07:49:07 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:37867: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 27 07:49:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-27 07:50:00 dovecot_plain authenticator failed for (prean) [77.239.255.163]:34036: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.149.50.114
description:
Jan 27 07:49:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.149.50.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 27 07:49:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-27 07:49:18 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:62746: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
description:
2025-01-27 07:49:27 dovecot_plain authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:14106: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.109.20.192
description:
2025-01-27 07:49:31 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:51801: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
description:
Jan 27 07:49:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 27 07:49:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-27 07:49:13 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:39160: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 27 07:49:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.71.37.202
description:
Jan 27 07:49:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.71.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
description:
2025-01-27 07:49:38 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:61773: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.203
description:
2025-01-27 07:49:50 dovecot_login authenticator failed for ([104.241.237.203]) [104.241.237.203]:57652: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.216.72
description:
2025-01-27 07:49:01 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:52252: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-27 07:49:12 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:33556: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
description:
Jan 27 07:49:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.149.50.114
description:
2025-01-27 07:49:44 dovecot_plain authenticator failed for net-93-149-50-114.cust.vodafonedsl.it (phaked) [93.149.50.114]:59693: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.203
description:
Jan 27 07:49:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-27 07:49:57 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:60276: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.66.180.131
description:
2025-01-27 07:49:06 dovecot_plain authenticator failed for (suile) [82.66.180.131]:56638: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.247.92.186
description:
2025-01-27 07:49:13 dovecot_login authenticator failed for ([60.247.92.186]) [60.247.92.186]:41092: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
description:
2025-01-27 07:49:35 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:37298: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-01-27 07:49:01 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net (subans) [77.157.174.51]:50255: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 27 07:49:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-01-27 07:49:23 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:36183: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
description:
Jan 27 07:49:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.202.224
description:
2025-01-27 07:49:27 dovecot_plain authenticator failed for ([196.46.202.224]) [196.46.202.224]:57565: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
description:
Jan 27 07:49:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.232.231
description:
Jan 27 07:49:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.232.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.232.231
description:
2025-01-27 07:49:37 dovecot_plain authenticator failed for ([27.45.232.231]) [27.45.232.231]:39475: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.66.180.131
description:
Jan 27 07:49:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.66.180.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.247.92.186
description:
Jan 27 07:49:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.247.92.186 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-49.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-27 07:49:47 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (heamenogy) [109.67.154.24]:56686: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 27 07:49:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.147.98.39
description:
Jan 27 07:49:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.147.98.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.124.119.7
description:
2025-01-27 07:49:38 dovecot_plain authenticator failed for ([118.122.255.5]) [118.124.119.7]:32226: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 07:50:10 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:32955: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 27 07:50:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-27 07:50:37 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:34468: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.117.113.43
description:
Jan 27 07:50:45 ait sshd[2735734]: pam_imunify(sshd:auth): [IM360_RBL] The IP 79.117.113.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.210
description:
2025-01-27 07:50:58 dovecot_login authenticator failed for ([195.178.110.210]) [195.178.110.210]:65210: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.40
description:
Jan 27 07:50:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-27 07:50:19 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:42463: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.254.95
description:
2025-01-27 07:50:29 dovecot_plain authenticator failed for (idiffilly) [185.254.254.95]:55608: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.235
description:
Jan 27 07:50:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.235 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 79.117.113.43
description:
Jan 27 07:50:45 ait sshd[2735734]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=79.117.113.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.12.201.7
description:
Jan 27 07:50:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.12.201.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 07:50:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.68.197.243
description:
[2025-01-27 07:50:55 +0100] info [webmaild] 105.68.197.243 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.210
description:
Jan 27 07:50:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.40
description:
2025-01-27 07:50:09 dovecot_plain authenticator failed for (reackly) [65.20.194.40]:55793: 535 Incorrect authentication data (set_id=eng20a00115y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 27 07:50:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.254.95
description:
Jan 27 07:50:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.254.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.207.24
description:
Jan 27 07:50:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.207.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.207.24
description:
2025-01-27 07:50:34 dovecot_plain authenticator failed for syn-076-176-207-024.res.spectrum.com [76.176.207.24]:49644: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.235
description:
2025-01-27 07:50:38 dovecot_plain authenticator failed for (rebal) [65.20.168.235]:50688: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 79.117.113.43
description:
Jan 27 07:50:47 ait sshd[2735734]: Failed password for invalid user invoices from 79.117.113.43 port 39370 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.201.7
description:
2025-01-27 07:50:48 dovecot_plain authenticator failed for ([59.12.201.7]) [59.12.201.7]:58197: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.140.69
description:
2025-01-27 07:51:38 dovecot_plain authenticator failed for (coaraize) [65.20.140.69]:41895: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 27 07:50:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-27 07:51:01 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:43462: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Jan 27 07:51:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.111.65
description:
Jan 27 07:51:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.111.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.111.65
description:
2025-01-27 07:51:17 dovecot_plain authenticator failed for h77-53-111-65.cust.bredband2.com [77.53.111.65]:43936: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Jan 27 07:51:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.140.69
description:
Jan 27 07:51:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.140.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
description:
Jan 27 07:51:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-01-27 07:51:11 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:35010: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-01-27 07:51:31 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:35492: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 27 07:51:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.203.28
description:
2025-01-27 07:51:57 dovecot_login authenticator failed for ([36.37.203.28]) [36.37.203.28]:59698: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-27 07:52:23 dovecot_plain authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:36518: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.240.66
description:
2025-01-27 07:52:26 dovecot_login authenticator failed for ([220.124.240.66]) [220.124.240.66]:65387: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.123.208.246
description:
Jan 27 07:52:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.123.208.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-27 07:51:59 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:53154: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 99.216.83.141
description:
Jan 27 07:52:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 99.216.83.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-01-27 07:52:09 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:47212: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.223.176.171
description:
Jan 27 07:52:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.223.176.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 27 07:52:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
description:
Jan 27 07:52:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.102.242
description:
2025-01-27 07:52:32 dovecot_login authenticator failed for ([80.227.102.242]) [80.227.102.242]:49553: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.102.242
description:
Jan 27 07:52:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.102.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.228.195.251
description:
Jan 27 07:52:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.228.195.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
description:
2025-01-27 07:52:41 dovecot_login authenticator failed for ([103.59.134.177]) [103.59.134.177]:4278: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.153.186.191
description:
Jan 27 07:52:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.153.186.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.186.191
description:
2025-01-27 07:52:45 dovecot_login authenticator failed for m106153186191.v4.enabler.ne.jp [106.153.186.191]:51694: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.216.83.141
description:
2025-01-27 07:52:11 dovecot_login authenticator failed for ([99.216.83.141]) [99.216.83.141]:53093: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 27 07:52:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-27 07:52:19 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:55781: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 216.10.214.28
description:
[2025-01-27 07:52:50 +0100] info [webmaild] 216.10.214.28 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.123.208.246
description:
2025-01-27 07:52:51 dovecot_login authenticator failed for 246.208.123.34.bc.googleusercontent.com [34.123.208.246]:57336: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.223.176.171
description:
2025-01-27 07:52:54 dovecot_login authenticator failed for ([50.223.176.171]) [50.223.176.171]:40012: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Jan 27 07:52:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
description:
Jan 27 07:52:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.228.195.251
description:
2025-01-27 07:52:39 dovecot_plain authenticator failed for ([116.228.195.251]) [116.228.195.251]:28005: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 27 07:53:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-27 07:53:08 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:36388: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.182.83.231
description:
Jan 27 07:53:12 ait sshd[2736884]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.182.83.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.182.83.231
description:
Jan 27 07:53:12 ait sshd[2736884]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.182.83.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 07:53:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.12.4
description:
[2025-01-27 07:54:21 +0100] info [webmaild] 191.99.12.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.85.134.20
description:
2025-01-27 07:54:03 dovecot_login authenticator failed for ([190.85.134.20]) [190.85.134.20]:43094: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
description:
2025-01-27 07:54:17 dovecot_plain authenticator failed for ([94.205.250.78]) [94.205.250.78]:53477: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.237.3
description:
2025-01-27 07:54:24 dovecot_plain authenticator failed for (broadband-37.204-237-3.ip.moscow.rt.ru) [37.204.237.3]:60988: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-27 07:54:38 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:52226: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
description:
2025-01-27 07:54:27 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:25927: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.182.90.67
description:
2025-01-27 07:54:34 dovecot_plain authenticator failed for ([107.182.90.67]) [107.182.90.67]:51267: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 27 07:54:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.49.15
description:
Jan 27 07:54:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.213.49.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.64.43.94
description:
[2025-01-27 07:54:24 +0100] info [webmaild] 102.64.43.94 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Jan 27 07:54:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
description:
Jan 27 07:54:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
description:
2025-01-27 07:54:44 dovecot_login authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:50365: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-01-27 07:54:45 dovecot_plain authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:48534: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.27.171.154
description:
Jan 27 07:54:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.27.171.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.27.171.154
description:
2025-01-27 07:54:57 dovecot_login authenticator failed for ([1.27.171.154]) [1.27.171.154]:52310: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.85.134.20
description:
Jan 27 07:54:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.85.134.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.250.78
description:
Jan 27 07:54:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.250.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.237.3
description:
Jan 27 07:54:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.237.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.182.90.67
description:
Jan 27 07:54:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.182.90.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
description:
2025-01-27 07:55:10 dovecot_plain authenticator failed for (psess) [65.20.184.80]:60375: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.182.83.231
description:
Jan 27 07:55:13 ait sshd[2738192]: pam_imunify(sshd:auth): [IM360_RBL] The IP 5.182.83.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.78.247.109
description:
2025-01-27 07:55:30 dovecot_plain authenticator failed for ([41.78.247.109]) [41.78.247.109]:56662: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.167.48.130
description:
Jan 27 07:55:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.167.48.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.167.48.130
description:
2025-01-27 07:55:28 dovecot_login authenticator failed for (5x167x48x130.dynamic.rostov.ertelecom.ru) [5.167.48.130]:34037: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.62
description:
2025-01-27 07:55:42 dovecot_login authenticator failed for (m121-202-154-62.smartone.com) [121.202.154.62]:27373: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.184.80
description:
Jan 27 07:55:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.21.118
description:
2025-01-27 07:55:14 dovecot_plain authenticator failed for ([5.16.21.118]) [5.16.21.118]:56232: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.62
description:
Jan 27 07:55:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.16.21.118
description:
Jan 27 07:55:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.16.21.118 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 5.182.83.231
description:
Jan 27 07:55:13 ait sshd[2738192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.182.83.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.78.247.109
description:
Jan 27 07:55:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.78.247.109 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.224.234.171
description:
[2025-01-27 07:55:38 +0100] info [webmaild] 181.224.234.171 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.35.18
description:
Jan 27 07:56:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.35.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.98.161
description:
Jan 27 07:56:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.98.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.98.161
description:
2025-01-27 07:56:14 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.98.161]:19105: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 07:56:26 ait sshd[2738837]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.201.228.210
description:
Jan 27 07:56:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.201.228.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-01-27 07:56:27 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:33940: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-27 07:56:29 dovecot_login authenticator failed for (SCZ-177-222-38-00009.tigo.bo) [177.222.38.9]:56872: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 195.211.237.130
description:
[2025-01-27 07:56:04 +0100] info [webmaild] 195.211.237.130 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 07:56:27 ait sshd[2738837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-56.194.163.182.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.80.180.91
description:
[2025-01-27 07:56:39 +0100] info [webmaild] 200.80.180.91 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.35.18
description:
2025-01-27 07:56:06 dovecot_login authenticator failed for ([60.174.35.18]) [60.174.35.18]:56095: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 27 07:56:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.188.61.236
description:
[2025-01-27 07:57:35 +0100] info [webmaild] 201.188.61.236 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.24.74.153
description:
[2025-01-27 07:57:05 +0100] info [webmaild] 181.24.74.153 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.218.106
description:
[2025-01-27 07:57:20 +0100] info [webmaild] 45.169.218.106 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-27 07:58:03 dovecot_login authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:41253: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 27 07:58:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-27 07:58:27 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:62740: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.154.222
description:
Jan 27 07:58:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.154.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.154.222
description:
2025-01-27 07:58:53 dovecot_login authenticator failed for ([39.165.154.222]) [39.165.154.222]:35542: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 27 07:58:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 07:58:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.239.87.6
description:
Jan 27 07:59:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.239.87.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.245.37
description:
Jan 27 07:59:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.245.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.245.37
description:
2025-01-27 07:59:08 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:9779: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 07:59:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Jan 27 08:00:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-01-27 08:00:04 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:42780: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.218.168.67
description:
Jan 27 08:00:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.218.168.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.218.168.67
description:
2025-01-27 08:00:14 dovecot_plain authenticator failed for (189.218.168.67-clientes-izzi.mx) [189.218.168.67]:58023: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.99.33.79
description:
[2025-01-27 08:00:52 +0100] info [webmaild] 191.99.33.79 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.225.169
description:
Jan 27 08:01:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.225.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 27 08:01:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-27 08:01:39 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:60786: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 08:01:51 ait sshd[2741769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.225.169
description:
2025-01-27 08:01:02 dovecot_login authenticator failed for net-2-37-225-169.cust.vodafonedsl.it [2.37.225.169]:39205: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-27 08:01:13 dovecot_login authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:49738: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 08:01:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 27 08:01:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.247.17.254
description:
[2025-01-27 08:01:45 +0100] info [webmaild] 201.247.17.254 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.183.76.192
description:
Jan 27 08:01:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.183.76.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 08:01:51 ait sshd[2741769]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.183.76.192
description:
2025-01-27 08:01:57 dovecot_login authenticator failed for ([59.183.76.192]) [59.183.76.192]:40220: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 27 08:02:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-27 08:02:14 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.132.14.159]:60864: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-02.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Jan 27 08:01:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.105.209
description:
[2025-01-27 08:02:15 +0100] info [webmaild] 170.82.105.209 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 08:02:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-01-27 08:02:01 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:36067: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 08:03:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 08:03:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.0.149.238
description:
Jan 27 08:04:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.0.149.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.0.149.238
description:
2025-01-27 08:04:04 dovecot_plain authenticator failed for net-130-0-149-238.cust.vodafonedsl.it (crully) [130.0.149.238]:52866: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 27 08:04:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-27 08:04:35 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:45418: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 27 08:04:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
description:
2025-01-27 08:04:52 dovecot_plain authenticator failed for (whipadated) [65.20.184.80]:58173: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-27 08:04:25 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:36179: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.184.80
description:
Jan 27 08:04:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.184.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 27 08:05:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-27 08:05:26 dovecot_login authenticator failed for 195-159-217-71.customer.powertech.no [195.159.217.71]:33634: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Jan 27 08:05:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-01-27 08:05:40 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:41556: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 08:04:59 ait sshd[2743483]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 08:04:59 ait sshd[2743483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 08:04:59 ait sshd[2743483]: Invalid user envergure224.com 2a00 from 111.231.56.128 port 41994


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
description:
2025-01-27 08:06:44 dovecot_login authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:36474: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 08:06:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 27 08:06:05 ait sshd[2744285]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 27 08:06:05 ait sshd[2744285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.185.185.235
description:
[2025-01-27 08:06:16 +0100] info [webmaild] 138.185.185.235 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.186
description:
Jan 27 08:06:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.186
description:
2025-01-27 08:06:17 dovecot_login authenticator failed for ([111.61.177.186]) [111.61.177.186]:28538: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.86.4
description:
Jan 27 08:06:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.86.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
description:
2025-01-27 08:06:30 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:48862: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
description:
Jan 27 08:06:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 27 08:07:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-27 08:07:08 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:58276: 535 Incorrect authentication data (set_id=helpdesk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.25.167.177
description:
2025-01-27 08:07:15 dovecot_login authenticator failed for c-76-25-167-177.hsd1.co.comcast.net [76.25.167.177]:53819: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 27 08:07:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-27 08:07:40 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:38484: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.240.97.42
description:
Jan 27 08:07:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.240.97.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.240.97.42
description:
2025-01-27 08:07:53 dovecot_login authenticator failed for 116-240-97-42.dyn.ip.vocus.au [116.240.97.42]:34737: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 08:07:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.25.167.177
description:
Jan 27 08:07:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.25.167.177 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 27 08:08:06 ait sshd[2745198]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.31.172
description:
Jan 27 08:08:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.31.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
description:
2025-01-27 08:08:02 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:37548: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.22.124
description:
Jan 27 08:08:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.22.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
description:
2025-01-27 08:08:27 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:17120: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-08.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-27 08:08:38 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:46126: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
description:
Jan 27 08:08:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Jan 27 08:08:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-01-27 08:08:24 dovecot_login authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:44728: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 27 08:08:06 ait sshd[2745198]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 27 08:08:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.22.124
description:
2025-01-27 08:08:12 dovecot_login authenticator failed for ([94.207.22.124]) [94.207.22.124]:52683: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-27 08:08:14 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:45973: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 27 08:08:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 27 08:09:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-27 08:09:51 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:1290: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 08:10:57 ait sshd[2746819]: Invalid user toolineo-werkstatt.de 2a03 from 122.51.104.242 port 40886


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 08:10:57 ait sshd[2746819]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.87.84.104
description:
Jan 27 08:10:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.87.84.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-27 08:10:11 dovecot_login authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:37916: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 27 08:10:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 27 08:10:30 ait sshd[2746535]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 08:10:57 ait sshd[2746819]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.87.84.104
description:
2025-01-27 08:10:08 dovecot_login authenticator failed for (88x87x84x104.static-customer.volgograd.ertelecom.ru) [88.87.84.104]:59959: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 27 08:10:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-27 08:10:23 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:19484: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 27 08:10:30 ait sshd[2746535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-27 08:11:54 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:45516: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Jan 27 08:11:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-01-27 08:11:40 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:58476: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-27 08:11:47 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:59366: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 27 08:11:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.211
description:
Jan 27 08:11:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.78
description:
Jan 27 08:11:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
description:
2025-01-27 08:11:40 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:35746: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 27 08:11:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.155
description:
2025-01-27 08:11:53 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:59980: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.155
description:
Jan 27 08:11:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.155 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 08:11:00 ait sshd[2746819]: Failed password for invalid user toolineo-werkstatt.de 2a03 from 122.51.104.242 port 40886 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 08:11:10 ait sshd[2746911]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 08:11:10 ait sshd[2746911]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.110.70.2
description:
Jan 27 08:12:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.110.70.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.98.249.9
description:
Jan 27 08:12:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.98.249.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 27 08:12:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-01-27 08:12:37 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:3675: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-27 08:12:01 dovecot_login authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:17647: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.110.70.2
description:
2025-01-27 08:12:07 dovecot_login authenticator failed for static-98-110-70-2.cmdnnj.fios.verizon.net [98.110.70.2]:37431: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.98.249.9
description:
2025-01-27 08:12:10 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:50220: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 08:12:17 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:45452: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-27 08:12:24 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:39997: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 27 08:12:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.10.94
description:
Jan 27 08:12:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.10.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Jan 27 08:12:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 08:12:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.10.94
description:
2025-01-27 08:12:03 dovecot_login authenticator failed for ([223.71.10.94]) [223.71.10.94]:49226: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 08:14:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.212.216
description:
[2025-01-27 08:14:03 +0100] info [webmaild] 45.228.212.216 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.108.63.73
description:
[2025-01-27 08:14:04 +0100] info [webmaild] 103.108.63.73 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-14.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.175.242
description:
Jan 27 08:14:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.175.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.242
description:
2025-01-27 08:14:45 dovecot_plain authenticator failed for (sillamfuze) [65.20.175.242]:44162: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.212.229.187
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:08-14.173.212.229.187


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 27 08:15:54 ait sshd[2749338]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 27 08:15:54 ait sshd[2749338]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 27 08:15:51 ait sshd[2749314]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 27 08:15:51 ait sshd[2749314]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-27 08:16:25 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:35582: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 27 08:16:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.232.107.108
description:
Jan 27 08:18:48 ait sshd[2751412]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.232.107.108


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.201
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:08-18.77.83.1.201


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.73.6
description:
[2025-01-27 08:18:46 +0100] info [webmaild] 84.54.73.6 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.232.107.108
description:
Jan 27 08:18:48 ait sshd[2751412]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.232.107.108 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.79.52.97
description:
Jan 27 08:19:06 ait sshd[2751632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.52.97


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-27 08:19:46 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:35280: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.79.52.97
description:
Jan 27 08:19:06 ait sshd[2751632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.79.52.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 27 08:19:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.248.26.21
description:
Jan 27 08:19:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.248.26.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 27 08:19:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.78.102
description:
[2025-01-27 08:19:45 +0100] info [webmaild] 84.54.78.102 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
description:
2025-01-27 08:19:46 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:48491: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.167.89
description:
Jan 27 08:19:04 ait sshd[2751623]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.167.89
description:
Jan 27 08:19:04 ait sshd[2751623]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.167.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
description:
Jan 27 08:19:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.205.108.31
description:
[2025-01-27 08:19:51 +0100] info [webmaild] 187.205.108.31 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-27 08:19:31 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:40904: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.248.26.21
description:
2025-01-27 08:19:34 dovecot_login authenticator failed for syn-067-248-026-021.res.spectrum.com [67.248.26.21]:47274: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 08:19:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.63
description:
Jan 27 08:20:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 27 08:20:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-20.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-27 08:20:55 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (tivellsh) [81.16.170.117]:37592: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.191.92.173
description:
Jan 27 08:20:01 ait sshd[2752057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.191.92.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.191.92.173
description:
Jan 27 08:20:01 ait sshd[2752057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.92.173


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.63
description:
2025-01-27 08:20:50 dovecot_login authenticator failed for ([92.118.39.63]) [92.118.39.63]:61670: 535 Incorrect authentication data (set_id=prueba)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.84.133.215
description:
[2025-01-27 08:22:00 +0100] info [webmaild] 103.84.133.215 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.126.165
description:
[2025-01-27 08:21:17 +0100] info [webmaild] 143.0.126.165 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 27 08:21:21 ait sshd[2753073]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 27 08:21:21 ait sshd[2753073]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.117
description:
47.128.123.117 - - [27/Jan/2025:08:21:42 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14468205 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/e077d7?panel=request" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.117


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.254.165.100
description:
Jan 27 08:21:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.254.165.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.254.165.100
description:
2025-01-27 08:21:46 dovecot_plain authenticator failed for 9498.telnet.bg (vinding) [87.254.165.100]:38528: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.253
description:
Jan 27 08:22:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.253
description:
2025-01-27 08:22:05 dovecot_plain authenticator failed for (aplavize) [65.20.129.253]:38831: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.118.221.29
description:
[2025-01-27 08:22:11 +0100] info [webmaild] 138.118.221.29 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.43.130.240
description:
[2025-01-27 08:22:28 +0100] info [webmaild] 38.43.130.240 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 08:22:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.189.98.181
description:
[2025-01-27 08:22:47 +0100] info [webmaild] 179.189.98.181 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.79.52.97
description:
Jan 27 08:24:26 ait sshd[2754769]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.79.52.97


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.232.107.108
description:
Jan 27 08:24:34 ait sshd[2755010]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.232.107.108


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.191.92.173
description:
Jan 27 08:24:22 ait sshd[2754755]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.92.173


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.79.52.97
description:
Jan 27 08:24:26 ait sshd[2754769]: pam_imunify(sshd:auth): [IM360_RBL] The IP 51.79.52.97 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 51.79.52.97
description:
Jan 27 08:24:28 ait sshd[2754769]: Failed password for invalid user hysteria from 51.79.52.97 port 43702 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.232.107.108
description:
Jan 27 08:24:34 ait sshd[2755010]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.232.107.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.191.92.173
description:
Jan 27 08:24:22 ait sshd[2754755]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.191.92.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 142.93.103.240
description:
Jan 27 08:25:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 142.93.103.240 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 27 08:25:38 ait sshd[2755757]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.144.230
description:
[2025-01-27 08:25:41 +0100] info [webmaild] 170.80.144.230 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.93.103.240
description:
2025-01-27 08:25:47 dovecot_plain authenticator failed for (supenish) [142.93.103.240]:59548: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 08:25:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 27 08:25:38 ait sshd[2755757]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 08:26:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.191.92.173
description:
Jan 27 08:26:00 ait sshd[2755852]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.191.92.173 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.191.92.173
description:
Jan 27 08:26:00 ait sshd[2755852]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.191.92.173


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.243.13
description:
[2025-01-27 08:26:02 +0100] info [webmaild] 41.56.243.13 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.167.89
description:
Jan 27 08:26:03 ait sshd[2755851]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.167.89
description:
Jan 27 08:26:03 ait sshd[2755851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.167.89


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 27 08:27:56 ait sshd[2756945]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 27 08:27:56 ait sshd[2756945]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-27.194.163.182.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.101.250.115
description:
[2025-01-27 08:27:10 +0100] info [webmaild] 187.101.250.115 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 08:27:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.167.89
description:
Jan 27 08:28:00 ait sshd[2756941]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.167.89
description:
Jan 27 08:28:00 ait sshd[2756941]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.167.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 08:29:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
description:
2025-01-27 08:30:29 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:52786: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Jan 27 08:30:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.116.74.70
description:
Jan 27 08:30:15 ait sshd[2757731]: pam_imunify(sshd:auth): [IM360_RBL] The IP 89.116.74.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.141.80.193
description:
2025-01-27 08:30:21 dovecot_login authenticator failed for (adsl-5-141-80-193.salekhard.ru) [5.141.80.193]:47256: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.141.80.193
description:
Jan 27 08:30:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.141.80.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
description:
Jan 27 08:30:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-01-27 08:30:41 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:33970: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 89.116.74.70
description:
Jan 27 08:30:15 ait sshd[2757731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=89.116.74.70


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 89.116.74.70
description:
Jan 27 08:30:17 ait sshd[2757731]: Failed password for invalid user ait from 89.116.74.70 port 36116 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 08:31:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.121.186.110
description:
[2025-01-27 08:31:58 +0100] info [webmaild] 138.121.186.110 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.205.182
description:
Jan 27 08:33:37 ait sshd[2759977]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.205.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.205.182
description:
Jan 27 08:33:37 ait sshd[2759977]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.205.182


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.149.214
description:
Jan 27 08:33:28 ait sshd[2759890]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.149.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.149.214
description:
Jan 27 08:33:28 ait sshd[2759890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.149.214


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-34.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.9.8
description:
Jan 27 08:34:13 ait sshd[2760163]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.9.8 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.9.8
description:
Jan 27 08:34:13 ait sshd[2760163]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.9.8


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.210
description:
Jan 27 08:34:53 ait sshd[2760724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.239.160.200
description:
Jan 27 08:34:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.239.160.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.239.160.200
description:
2025-01-27 08:34:22 dovecot_plain authenticator failed for ([218.239.160.200]) [218.239.160.200]:42270: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.187.62.248
description:
Jan 27 08:34:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.187.62.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.187.62.248
description:
2025-01-27 08:34:30 dovecot_plain authenticator failed for ([188.187.62.248]) [188.187.62.248]:57484: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.210
description:
Jan 27 08:34:53 ait sshd[2760724]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.210  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.210
description:
Jan 27 08:35:01 ait sshd[2760724]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.149.214
description:
Jan 27 08:37:30 ait sshd[2762247]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.149.214 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 08:37:00 ait sshd[2761609]: Invalid user envergure224.com 2a00 from 111.231.56.128 port 53524


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.149.214
description:
Jan 27 08:37:30 ait sshd[2762247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.149.214


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 08:37:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 08:37:00 ait sshd[2761609]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 08:37:00 ait sshd[2761609]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.205.182
description:
Jan 27 08:37:23 ait sshd[2762214]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.205.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.205.182
description:
Jan 27 08:37:23 ait sshd[2762214]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.205.182


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.66.213.94
description:
[2025-01-27 08:37:25 +0100] info [webmaild] 177.66.213.94 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 27 08:38:34 ait sshd[2762709]: Invalid user universitypublishing from 116.122.157.193 port 48654


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 27 08:38:35 ait sshd[2762709]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 08:38:35 ait sshd[2762709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.149.214
description:
Jan 27 08:38:52 ait sshd[2762802]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.149.214 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.149.214
description:
Jan 27 08:38:52 ait sshd[2762802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.149.214


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.205.182
description:
Jan 27 08:38:53 ait sshd[2762800]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.205.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.205.182
description:
Jan 27 08:38:53 ait sshd[2762800]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.205.182


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.149.214
description:
Jan 27 08:38:55 ait sshd[2762802]: Failed password for invalid user user1 from 64.227.149.214 port 43148 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.70.39.68
description:
Jan 27 08:39:45 ait sshd[2763337]: pam_imunify(sshd:auth): [IM360_RBL] The IP 13.70.39.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.9.8
description:
Jan 27 08:39:15 ait sshd[2763042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.9.8


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 13.70.39.68
description:
Jan 27 08:39:45 ait sshd[2763337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.70.39.68


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.10.212.162
description:
[2025-01-27 08:39:58 +0100] info [webmaild] 191.10.212.162 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.9.8
description:
Jan 27 08:39:15 ait sshd[2763042]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.9.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 27 08:40:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.187.9.8
description:
Jan 27 08:40:34 ait sshd[2764080]: pam_imunify(sshd:auth): [IM360_RBL] The IP 52.187.9.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 08:40:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-40.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 52.187.9.8
description:
Jan 27 08:40:34 ait sshd[2764080]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=52.187.9.8


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 27 08:40:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-27 08:40:46 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:17657: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.123.125.197
description:
Jan 27 08:40:23 ait sshd[2763712]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.123.125.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-27 08:41:01 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:33808: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.48.227.118
description:
Jan 27 08:41:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.48.227.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.227.118
description:
2025-01-27 08:41:47 dovecot_login authenticator failed for ([14.48.227.118]) [14.48.227.118]:46679: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Jan 27 08:41:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.70.39.68
description:
Jan 27 08:41:40 ait sshd[2764849]: pam_imunify(sshd:auth): [IM360_RBL] The IP 13.70.39.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 13.70.39.68
description:
Jan 27 08:41:40 ait sshd[2764849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.70.39.68


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 150.136.222.122
domain: ait.university
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/img/about.php||SC:/home/titlemas/public_html/ait.university/img


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-27 08:41:52 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:56184: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 150.136.222.122
domain: ait.university
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:08-41.150.136.222.122||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 42.123.125.197
description:
Jan 27 08:41:13 ait sshd[2764487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=42.123.125.197


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-01-27 08:41:41 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:35866: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 27 08:41:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 27 08:41:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-27 08:42:01 dovecot_login authenticator failed for ([203.128.181.121]) [203.128.181.121]:46202: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 27 08:42:27 ait sshd[2765193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 08:42:27 ait sshd[2765193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 13.70.39.68
description:
Jan 27 08:43:09 ait sshd[2765597]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=13.70.39.68


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.106.198.35
description:
Jan 27 08:43:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.106.198.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.237.8.37
description:
2025-01-27 08:43:42 dovecot_login authenticator failed for ([58.237.8.37]) [58.237.8.37]:59827: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-27 08:43:13 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:49764: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Jan 27 08:43:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.106.198.35
description:
2025-01-27 08:43:30 dovecot_login authenticator failed for ([222.106.198.35]) [222.106.198.35]:48656: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.172
description:
2025-01-27 08:43:43 dovecot_login authenticator failed for ([104.241.237.172]) [104.241.237.172]:40942: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 27 08:43:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.223
description:
Jan 27 08:43:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.82.124
description:
Jan 27 08:43:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.82.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.236.82.124
description:
2025-01-27 08:43:29 dovecot_login authenticator failed for (124.82.236.45.cable.dyn.ridsa.com.ar) [45.236.82.124]:38459: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.237.8.37
description:
Jan 27 08:43:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.237.8.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.177.79.74
description:
Jan 27 08:43:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.177.79.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-27 08:43:28 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:44012: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 13.70.39.68
description:
Jan 27 08:43:09 ait sshd[2765597]: pam_imunify(sshd:auth): [IM360_RBL] The IP 13.70.39.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-27 08:43:27 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:39826: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.166.112.154
description:
2025-01-27 08:43:48 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:49611: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.242.98.250
description:
Jan 27 08:43:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.242.98.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 27 08:43:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.172
description:
Jan 27 08:43:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.166.112.154
description:
Jan 27 08:43:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.166.112.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.218.163.130
description:
2025-01-27 08:44:03 dovecot_login authenticator failed for ([58.218.163.130]) [58.218.163.130]:49114: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.218.95.154
description:
Jan 27 08:44:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.218.95.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
description:
2025-01-27 08:44:15 dovecot_login authenticator failed for syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:45681: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Jan 27 08:44:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-01-27 08:44:20 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:48552: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.251.14.171
description:
[2025-01-27 08:44:39 +0100] info [webmaild] 41.251.14.171 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.175.253.49
description:
Jan 27 08:44:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.175.253.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 27 08:44:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
description:
Jan 27 08:44:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
description:
2025-01-27 08:44:05 dovecot_login authenticator failed for ([222.186.68.153]) [222.186.68.153]:36663: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 27 08:44:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.206.76
description:
2025-01-27 08:44:07 dovecot_login authenticator failed for ([14.37.206.76]) [14.37.206.76]:41149: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-27 08:44:08 dovecot_login authenticator failed for ([121.175.8.140]) [121.175.8.140]:49238: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Jan 27 08:44:11 ait sshd[2766111]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Jan 27 08:44:11 ait sshd[2766111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.218.163.130
description:
Jan 27 08:44:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.218.163.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.91.147.190
description:
2025-01-27 08:44:18 dovecot_login authenticator failed for 213-91-147-190.ip.btc-net.bg [213.91.147.190]:36944: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-27 08:44:48 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:34806: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.66
description:
Jan 27 08:44:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.91.147.190
description:
Jan 27 08:44:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.91.147.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.2.99
description:
Jan 27 08:44:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.2.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.175.253.49
description:
2025-01-27 08:44:04 dovecot_login authenticator failed for ([89.175.253.49]) [89.175.253.49]:54946: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Jan 27 08:44:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-01-27 08:44:32 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:43084: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.206.76
description:
Jan 27 08:44:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.206.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 27 08:45:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.205.244.221
description:
Jan 27 08:45:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.205.244.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.66
description:
2025-01-27 08:45:01 dovecot_login authenticator failed for ([104.241.237.66]) [104.241.237.66]:49868: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
description:
Jan 27 08:45:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-27 08:45:34 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:37964: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 27 08:45:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-01-27 08:45:50 dovecot_login authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:48317: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.217.10
description:
[2025-01-27 08:45:27 +0100] info [webmaild] 138.59.217.10 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 27 08:45:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Jan 27 08:45:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-27 08:45:28 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:38044: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.88.121.73
description:
Jan 27 08:45:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.88.121.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.88.121.73
description:
2025-01-27 08:45:38 dovecot_login authenticator failed for ([115.88.121.73]) [115.88.121.73]:50518: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 27 08:45:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 08:45:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 08:45:43 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:58660: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-27 08:45:44 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:23603: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-27 08:45:44 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:40376: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-27 08:45:57 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:36004: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-01-27 08:45:27 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:4810: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.45.11.79
description:
Jan 27 08:45:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.45.11.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.205.244.221
description:
2025-01-27 08:45:42 dovecot_login authenticator failed for (191-205-244-221.user.vivozap.com.br) [191.205.244.221]:43765: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Jan 27 08:45:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
description:
2025-01-27 08:45:26 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:39678: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 27 08:45:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
description:
Jan 27 08:45:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 27 08:46:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-27 08:46:19 dovecot_login authenticator failed for ([222.92.61.242]) [222.92.61.242]:46028: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.166.112.154
description:
2025-01-27 08:46:30 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:54636: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 27 08:46:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 27 08:46:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-27 08:46:53 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:43874: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.126.23.136
description:
[2025-01-27 08:46:12 +0100] info [webmaild] 103.126.23.136 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 27 08:46:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-27 08:46:38 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:22076: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.49.23
description:
Jan 27 08:46:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.49.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.4.98
description:
Jan 27 08:46:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.49.23
description:
2025-01-27 08:46:48 dovecot_login authenticator failed for ([185.113.49.23]) [185.113.49.23]:35097: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-01-27 08:46:00 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:57436: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
description:
2025-01-27 08:46:00 dovecot_login authenticator failed for ([61.164.202.219]) [61.164.202.218]:5704: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.209.141.145
description:
Jan 27 08:46:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.209.141.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.145
description:
2025-01-27 08:46:39 dovecot_login authenticator failed for 95.209.141.145.bredband.tre.se [95.209.141.145]:51480: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.4.98
description:
2025-01-27 08:46:51 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:26720: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.166.112.154
description:
Jan 27 08:46:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.166.112.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-27 08:46:33 dovecot_login authenticator failed for net-2-32-137-250.cust.vodafonedsl.it (net-2-32-137-250.cust.dsl.teletu.it) [2.32.137.250]:48800: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 210.211.60.133
description:
[2025-01-27 08:47:44 +0100] info [webmaild] 210.211.60.133 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.161.98
description:
[2025-01-27 08:47:54 +0100] info [webmaild] 170.254.161.98 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-27 08:47:55 dovecot_login authenticator failed for ([171.244.40.228]) [171.244.40.236]:47885: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Jan 27 08:47:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.105.182.88
description:
Jan 27 08:47:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.105.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 27 08:47:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-27 08:47:38 dovecot_login authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:49195: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
description:
2025-01-27 08:47:40 dovecot_login authenticator failed for ([112.194.143.206]) [112.194.143.206]:58164: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.105.182.88
description:
2025-01-27 08:47:42 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:53798: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 27 08:47:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-47.194.163.182.227


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.239.151
description:
[2025-01-27 08:47:17 +0100] info [webmaild] 170.79.239.151 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-27 08:48:10 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:49766: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 106.0.54.155
description:
[2025-01-27 08:48:24 +0100] info [webmaild] 106.0.54.155 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-27 08:48:29 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:35170: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 08:48:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 27 08:48:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-27 08:48:06 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:33732: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 08:48:06 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:35411: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 27 08:48:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 27 08:48:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.235.220.214
description:
[2025-01-27 08:48:43 +0100] info [webmaild] 186.235.220.214 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 27 08:49:15 ait sshd[2768382]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 205.164.163.111
description:
[2025-01-27 08:49:24 +0100] info [webmaild] 205.164.163.111 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 08:49:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.238.178.211
description:
[2025-01-27 08:49:08 +0100] info [webmaild] 41.238.178.211 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 27 08:49:15 ait sshd[2768382]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 27 08:50:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-27 08:50:03 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:39872: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.26
description:
Jan 27 08:50:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.26
description:
2025-01-27 08:50:15 dovecot_login authenticator failed for ([104.241.233.26]) [104.241.233.26]:56153: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 08:50:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.61
description:
2025-01-27 08:51:59 dovecot_login authenticator failed for ([92.118.39.61]) [92.118.39.61]:64435: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 08:51:07 ait sshd[2769562]: Invalid user envergure224.com 2a00 from 111.231.56.128 port 58978


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 08:51:07 ait sshd[2769562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 08:51:18 ait sshd[2769591]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 08:51:07 ait sshd[2769562]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 08:51:18 ait sshd[2769591]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.187.96.237
description:
[2025-01-27 08:51:36 +0100] info [webmaild] 200.187.96.237 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.61
description:
Jan 27 08:51:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.37.139
description:
[2025-01-27 08:52:50 +0100] info [webmaild] 201.71.37.139 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Jan 27 08:53:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-01-27 08:53:08 dovecot_login authenticator failed for ([65.20.251.53]) [65.20.251.53]:60834: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Jan 27 08:53:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-01-27 08:53:25 dovecot_login authenticator failed for ([195.252.209.189]) [195.252.209.189]:51036: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.155.40.53
description:
Jan 27 08:55:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.155.40.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.155.40.53
description:
2025-01-27 08:55:43 dovecot_login authenticator failed for ([122.155.40.53]) [122.155.40.53]:58266: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 27 08:55:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-27 08:55:57 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:56048: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Jan 27 08:56:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
description:
2025-01-27 08:56:42 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:59178: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:08-56.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 27 08:56:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-01-27 08:56:54 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:48394: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.14.122
description:
Jan 27 08:57:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-27 08:57:54 dovecot_login authenticator failed for ([185.255.212.178]) [185.255.212.178]:1914: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 08:57:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.17.103.27
description:
[2025-01-27 08:57:48 +0100] info [webmaild] 188.17.103.27 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 27 08:57:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.30.14.122
description:
2025-01-27 08:57:52 dovecot_login authenticator failed for ([185.30.14.122]) [185.30.14.122]:53870: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 08:57:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-27 08:58:49 dovecot_login authenticator failed for ([218.22.187.70]) [218.22.187.66]:39306: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 27 08:58:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-01-27 08:58:05 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:7771: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-01-27 08:58:35 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:38496: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 27 08:58:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-27 08:58:48 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:37345: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-27 08:58:35 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:29424: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 08:58:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 27 08:58:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-27 08:58:52 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:40180: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.133.206
description:
Jan 27 08:58:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.133.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 27 08:58:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-27 08:58:35 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:33483: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.134.13.108
description:
Jan 27 08:58:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.134.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.209.173.203
description:
Jan 27 08:58:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.209.173.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.114.41
description:
2025-01-27 08:58:52 dovecot_login authenticator failed for ([5.26.114.41]) [5.26.114.41]:35340: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.134.13.108
description:
2025-01-27 08:58:53 dovecot_login authenticator failed for ([117.134.13.108]) [117.134.13.108]:63544: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.133.206
description:
2025-01-27 08:58:13 dovecot_login authenticator failed for syn-035-130-133-206.biz.spectrum.com [35.130.133.206]:57622: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 27 08:58:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Jan 27 08:58:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 27 08:58:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.114.41
description:
Jan 27 08:58:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.114.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
description:
Jan 27 08:59:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
description:
2025-01-27 08:59:53 dovecot_login authenticator failed for ([110.14.192.20]) [110.14.192.20]:56142: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.209.173.203
description:
2025-01-27 08:59:00 dovecot_login authenticator failed for (203.173.209.139.adsl-pool.jlccptt.net.cn) [139.209.173.203]:32816: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-27 08:59:06 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:55874: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-27 08:59:06 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:37428: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 27 08:59:08 ait sshd[2772344]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.68.46
description:
Jan 27 08:59:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.68.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.188.165.198
description:
Jan 27 08:59:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.188.165.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 27 08:58:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 27 08:59:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 27 08:59:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.134.13.108
description:
Jan 27 08:59:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.134.13.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.68.46
description:
2025-01-27 08:59:22 dovecot_login authenticator failed for ([59.98.150.190]) [122.160.68.46]:34286: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-27 08:59:01 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:19376: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 27 08:59:08 ait sshd[2772344]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.134.13.108
description:
2025-01-27 08:59:14 dovecot_login authenticator failed for ([117.134.13.108]) [117.134.13.108]:1072: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.188.165.198
description:
2025-01-27 08:59:31 dovecot_login authenticator failed for ([202.188.165.198]) [202.188.165.198]:55609: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: aitonline.us
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:ait002||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-27 09:00:21 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:41746: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
description:
2025-01-27 09:00:48 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:41820: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 27 09:00:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: elma-hk.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:elmahkco||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 27 09:00:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 27 09:00:03 ait sshd[2772822]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.141
description:
2025-01-27 09:00:39 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:47829: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 27 09:00:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.47.214
description:
Jan 27 09:00:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.237.47.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-27 09:00:48 dovecot_login authenticator failed for ([93.182.160.222]) [93.182.160.222]:35014: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 27 09:00:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: elmisa.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:elmisa||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 27 09:00:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-27 09:00:45 dovecot_login authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:53292: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: goudirect.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:goudirect006||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-27 09:00:21 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:37236: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: gou.university
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:gou002||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
description:
2025-01-27 09:00:11 dovecot_login authenticator failed for 229.sub-166-141-241.myvzw.com [166.141.241.229]:45446: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.141
description:
Jan 27 09:00:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 27 09:00:03 ait sshd[2772822]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: myait.org
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:myait002||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: worldwide-university.com
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:wwuni002||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.141.241.229
description:
Jan 27 09:00:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.141.241.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-27 09:00:10 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:42454: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.254.244.211
description:
2025-01-27 09:01:21 dovecot_login authenticator failed for (user-static-94-254-244-211.mobile.play-internet.pl) [94.254.244.211]:60482: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Jan 27 09:00:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-01-27 09:01:01 dovecot_login authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:37772: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.153.111.165
description:
[2025-01-27 09:01:05 +0100] info [webmaild] 186.153.111.165 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.93.113.138
description:
2025-01-27 09:01:14 dovecot_login authenticator failed for ([41.93.113.138]) [41.93.113.138]:35574: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.254.244.211
description:
Jan 27 09:01:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.254.244.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 09:02:02 ait sshd[2773726]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.170
description:
Jan 27 09:02:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 27 09:02:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-27 09:02:41 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:42804: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 09:02:02 ait sshd[2773726]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
description:
2025-01-27 09:02:21 dovecot_login authenticator failed for ([116.114.84.170]) [116.114.84.170]:32899: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-27 09:02:31 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:57546: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
description:
Jan 27 09:02:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-03.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 27 09:03:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 27 09:03:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-27 09:03:03 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:59715: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Jan 27 09:03:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
description:
Jan 27 09:03:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
description:
2025-01-27 09:03:14 dovecot_login authenticator failed for ([41.220.3.113]) [41.220.3.101]:18182: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.126.202.247
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-03.185.126.202.247


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-01-27 09:03:09 dovecot_login authenticator failed for ([14.37.79.247]) [14.37.79.247]:55345: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-27 09:03:29 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:45208: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 27 09:04:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 09:04:18 ait sshd[2774483]: Invalid user toolineo-werkstatt.de 2a03 from 122.51.104.242 port 57890


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 09:04:18 ait sshd[2774483]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 09:04:18 ait sshd[2774483]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.151.38.224
description:
Jan 27 09:04:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.151.38.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 27 09:04:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 27 09:04:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-27 09:04:52 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:58820: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-27 09:04:20 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:35092: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.151.38.224
description:
2025-01-27 09:04:33 dovecot_login authenticator failed for (undefined.hostname.localhost) [103.151.38.224]:54031: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-27 09:04:48 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:34558: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: ait.edu.gh
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:ait02||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 09:05:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.253.142
description:
Jan 27 09:05:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.253.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.142
description:
2025-01-27 09:05:13 dovecot_login authenticator failed for ([116.113.253.142]) [116.113.253.142]:47154: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.36.219.18
description:
[2025-01-27 09:05:43 +0100] info [webmaild] 191.36.219.18 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.2.202
description:
Jan 27 09:06:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.2.202
description:
2025-01-27 09:06:59 dovecot_login authenticator failed for ([221.224.2.202]) [221.224.2.202]:52523: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.29.118.52
description:
Jan 27 09:06:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.29.118.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.29.118.52
description:
2025-01-27 09:06:25 dovecot_login authenticator failed for (173-29-118-52.client.mchsi.com) [173.29.118.52]:61889: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 27 09:06:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-27 09:06:38 dovecot_login authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:49513: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.65
description:
Jan 27 09:06:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.65
description:
2025-01-27 09:06:53 dovecot_login authenticator failed for ([92.118.39.65]) [92.118.39.65]:55303: 535 Incorrect authentication data (set_id=accounts)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 27 09:07:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 27 09:07:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-27 09:07:15 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:16614: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
description:
Jan 27 09:07:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Jan 27 09:07:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 27 09:07:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.180.118.166
description:
Jan 27 09:07:17 ait sshd[2775922]: Invalid user universitypublishing from 210.180.118.166 port 53748


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
description:
2025-01-27 09:07:38 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:64471: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
description:
2025-01-27 09:07:52 dovecot_login authenticator failed for ([119.200.229.33]) [119.200.229.33]:50501: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-27 09:07:02 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:44066: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-27 09:07:12 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:34294: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 09:07:17 ait sshd[2775922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.42.100
description:
Jan 27 09:07:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.42.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-01-27 09:07:59 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:38034: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 09:07:17 ait sshd[2775922]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 27 09:08:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-27 09:08:11 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:51812: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.74.36
description:
Jan 27 09:08:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.74.36
description:
2025-01-27 09:08:57 dovecot_login authenticator failed for ([164.92.74.36]) [164.92.74.36]:40500: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.240
description:
Jan 27 09:09:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.240 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-09.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.18.126.17
description:
Jan 27 09:09:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.18.126.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.153.138
description:
Jan 27 09:09:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.153.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.11.169.7
description:
2025-01-27 09:09:15 dovecot_plain authenticator failed for (122.11.169-7.unknown.starhub.net.sg) [122.11.169.7]:1855: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 27 09:09:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.228.136
description:
Jan 27 09:09:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.18.126.17
description:
2025-01-27 09:09:06 dovecot_plain authenticator failed for 17.red-88-18-126.staticip.rima-tde.net [88.18.126.17]:52419: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.11.169.7
description:
Jan 27 09:09:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.11.169.7 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 09:09:34 ait sshd[2776686]: Invalid user envergure224.com 2a00 from 111.231.56.128 port 34392


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 09:09:34 ait sshd[2776686]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 09:09:34 ait sshd[2776686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 109.228.57.19
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-09.109.228.57.19


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.153.138
description:
2025-01-27 09:09:15 dovecot_login authenticator failed for ([223.197.153.138]) [223.197.153.138]:55981: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-27 09:09:17 dovecot_login authenticator failed for ([203.123.219.137]) [203.123.219.137]:57892: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.136
description:
2025-01-27 09:09:30 dovecot_login authenticator failed for ([218.149.228.136]) [218.149.228.136]:51523: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
description:
2025-01-27 09:09:34 dovecot_plain authenticator failed for 111-70-23-240.emome-ip.hinet.net [111.70.23.240]:49405: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 27 09:09:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-27 09:09:55 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:40713: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.87.228
description:
Jan 27 09:10:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.87.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Jan 27 09:10:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.112
description:
Jan 27 09:10:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.112
description:
2025-01-27 09:10:52 dovecot_login authenticator failed for ([183.249.1.112]) [183.249.1.112]:59762: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-01-27 09:10:28 dovecot_login authenticator failed for ([112.172.126.247]) [112.172.126.247]:39638: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.147.155
description:
2025-01-27 09:10:50 dovecot_login authenticator failed for 155.147.48.116.static.netvigator.com [116.48.147.155]:55594: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.232.252
description:
Jan 27 09:10:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.232.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.232.252
description:
2025-01-27 09:10:15 dovecot_login authenticator failed for ([104.241.232.252]) [104.241.232.252]:45437: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-01-27 09:10:17 dovecot_plain authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:60694: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
description:
Jan 27 09:10:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
description:
2025-01-27 09:10:51 dovecot_login authenticator failed for ([60.174.39.82]) [60.174.39.82]:35511: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.87.228
description:
2025-01-27 09:10:12 dovecot_login authenticator failed for s2.legionusa.com [159.203.87.228]:40368: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
description:
Jan 27 09:10:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.8.167.241
description:
2025-01-27 09:10:29 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:3101: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Jan 27 09:10:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.85.19.128
description:
[2025-01-27 09:10:23 +0100] info [webmaild] 187.85.19.128 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Jan 27 09:10:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.204
description:
2025-01-27 09:10:33 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:64064: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.147.155
description:
Jan 27 09:10:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.147.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.109.1.49
description:
Jan 27 09:11:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.109.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-27 09:11:20 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38573: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 27 09:11:48 ait sshd[2777688]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.109.1.49
description:
2025-01-27 09:11:09 dovecot_login authenticator failed for ([182.109.1.49]) [182.109.1.49]:45427: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.78
description:
Jan 27 09:11:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.78
description:
2025-01-27 09:11:37 dovecot_login authenticator failed for ([111.61.176.78]) [111.61.176.78]:47576: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
description:
2025-01-27 09:11:50 dovecot_login authenticator failed for ([154.144.255.210]) [154.144.255.210]:50056: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
description:
Jan 27 09:11:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-27 09:11:08 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:18458: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 27 09:11:48 ait sshd[2777688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.94.232.121
description:
[2025-01-27 09:11:59 +0100] info [webmaild] 181.94.232.121 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.190.194.56
description:
[2025-01-27 09:11:08 +0100] info [webmaild] 186.190.194.56 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 27 09:11:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.210
description:
Jan 27 09:11:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.210 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.94.27
description:
[2025-01-27 09:12:43 +0100] info [webmaild] 177.11.94.27 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
description:
Jan 27 09:12:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
description:
2025-01-27 09:12:04 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:44002: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 09:12:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 09:12:28 dovecot_login authenticator failed for ([175.202.82.251]) [175.202.82.251]:34624: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.156.136.239
description:
2025-01-27 09:13:36 dovecot_login authenticator failed for ([114.143.224.97]) [182.156.136.239]:52143: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
description:
Jan 27 09:13:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-27 09:13:20 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:49814: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Jan 27 09:13:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.249.74.253
description:
[2025-01-27 09:13:52 +0100] info [webmaild] 41.249.74.253 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.38
description:
2025-01-27 09:13:54 dovecot_login authenticator failed for ([1.28.87.38]) [1.28.87.38]:47397: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.23.94.17
description:
[2025-01-27 09:13:09 +0100] info [webmaild] 102.23.94.17 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.101.234.165
description:
[2025-01-27 09:13:11 +0100] info [webmaild] 187.101.234.165 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-27 09:13:25 dovecot_login authenticator failed for ([14.37.125.43]) [14.37.125.43]:34149: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.156.136.239
description:
Jan 27 09:13:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.156.136.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 27 09:13:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 27 09:13:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.38
description:
Jan 27 09:13:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.224.33.197
description:
2025-01-27 09:13:54 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.33.197]:26937: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-01-27 09:13:33 dovecot_login authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:43110: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.3
description:
2025-01-27 09:13:39 dovecot_login authenticator failed for ([111.61.177.3]) [111.61.177.3]:26684: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.33.197
description:
Jan 27 09:13:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.33.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.75.107
description:
[2025-01-27 09:14:05 +0100] info [webmaild] 143.255.75.107 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 27 09:14:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 09:14:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 09:14:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.248.7
description:
Jan 27 09:14:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.248.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-01-27 09:14:58 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:1497: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 27 09:14:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.1.154
description:
2025-01-27 09:14:09 dovecot_login authenticator failed for 110-4-1-154.static.pccw-hkt.com [110.4.1.154]:46024: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-27 09:14:21 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:47014: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-27 09:14:32 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:42674: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.231.133.131
description:
[2025-01-27 09:14:44 +0100] info [webmaild] 88.231.133.131 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 27 09:14:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Jan 27 09:14:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.248.7
description:
2025-01-27 09:14:48 dovecot_plain authenticator failed for 7.248.146.34.bc.googleusercontent.com [34.146.248.7]:38026: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-27 09:14:05 dovecot_login authenticator failed for ([37.224.119.19]) [37.224.119.19]:33534: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.1.154
description:
Jan 27 09:14:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.1.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 09:14:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 09:14:28 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:45563: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-27 09:15:35 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:54492: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.170.225.80
description:
2025-01-27 09:15:45 dovecot_plain authenticator failed for ([103.170.225.80]) [103.170.225.80]:32788: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.119.2
description:
Jan 27 09:15:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.119.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.170.225.80
description:
Jan 27 09:15:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.170.225.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 27 09:15:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-27 09:15:48 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:42214: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.119.2
description:
2025-01-27 09:15:55 dovecot_plain authenticator failed for ([180.168.119.2]) [180.168.119.2]:53873: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.166.103
description:
[2025-01-27 09:15:24 +0100] info [webmaild] 45.70.166.103 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 27 09:15:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 09:16:28 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (spascuped) [51.255.84.180]:56814: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 130.162.165.238
description:
Jan 27 09:16:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 130.162.165.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Jan 27 09:16:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
description:
2025-01-27 09:16:24 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:43951: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 09:16:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.162.165.238
description:
2025-01-27 09:16:47 dovecot_plain authenticator failed for (devity) [130.162.165.238]:58552: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-16.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 27 09:16:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-27 09:16:38 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:49630: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
description:
2025-01-27 09:17:10 dovecot_login authenticator failed for ([125.139.124.120]) [125.139.124.120]:53046: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
description:
Jan 27 09:17:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
description:
Jan 27 09:17:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
description:
2025-01-27 09:17:31 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:38438: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 27 09:17:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-27 09:17:34 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (phoboa) [81.237.110.29]:58514: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
description:
Jan 27 09:17:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.1.255.86
description:
[2025-01-27 09:17:02 +0100] info [webmaild] 46.1.255.86 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.80.201
description:
2025-01-27 09:17:55 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:64390: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.255.120.74
description:
Jan 27 09:18:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.255.120.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.255.120.74
description:
2025-01-27 09:18:19 dovecot_login authenticator failed for ([60.255.120.74]) [60.255.120.74]:39526: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 5758
name: Maximum authentication attempts exceeded.
abuser: 218.92.0.209
description:
Jan 27 09:18:24 ait sshd[2780375]: error: maximum authentication attempts exceeded for root from 218.92.0.209 port 50494 ssh2 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.105.130.180
description:
[2025-01-27 09:18:33 +0100] info [webmaild] 179.105.130.180 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.209
description:
Jan 27 09:18:03 ait sshd[2780375]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.209 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.209
description:
Jan 27 09:18:03 ait sshd[2780375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.209  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 09:19:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 27 09:19:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-27 09:19:54 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:34940: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.110.53.177
description:
Jan 27 09:20:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.110.53.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.110.53.177
description:
2025-01-27 09:20:06 dovecot_login authenticator failed for (123-110-53-177.cctv.dynamic.tbcnet.net.tw) [123.110.53.177]:49135: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 27 09:20:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-27 09:20:43 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:60962: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.67.121.58
description:
2025-01-27 09:20:48 dovecot_login authenticator failed for ([124.67.121.58]) [124.67.121.58]:58257: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 09:20:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.89.202.226
description:
Jan 27 09:20:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.89.202.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.89.202.226
description:
2025-01-27 09:20:56 dovecot_login authenticator failed for syn-097-089-202-226.biz.spectrum.com [97.89.202.226]:48397: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.159.145.190
description:
Jan 27 09:20:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.159.145.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.159.145.190
description:
2025-01-27 09:20:58 dovecot_plain authenticator failed for ([41.159.145.190]) [41.159.145.190]:33198: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.67.121.58
description:
Jan 27 09:20:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.67.121.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.83
description:
2025-01-27 09:21:46 dovecot_plain authenticator failed for 083.42.246.220.static.netvigator.com [220.246.42.83]:64106: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.102.165.200
description:
2025-01-27 09:21:08 dovecot_plain authenticator failed for (82-102-165-200.orange.net.il) [82.102.165.200]:43553: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
description:
2025-01-27 09:21:34 dovecot_plain authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:40759: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.126.212.30
description:
2025-01-27 09:21:41 dovecot_plain authenticator failed for ([129.126.212.30]) [129.126.212.30]:40117: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-01-27 09:21:03 dovecot_login authenticator failed for ([115.23.241.161]) [115.23.241.161]:58474: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.249.167.45
description:
Jan 27 09:21:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.249.167.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.126.212.30
description:
Jan 27 09:21:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.126.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.125.14.122
description:
Jan 27 09:21:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.125.14.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.249.167.45
description:
2025-01-27 09:21:32 dovecot_plain authenticator failed for ([50.249.167.45]) [50.249.167.45]:48051: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.83
description:
Jan 27 09:21:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
description:
Jan 27 09:21:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.102.165.200
description:
Jan 27 09:21:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.102.165.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 09:21:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 09:22:55 ait sshd[2782535]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 09:22:55 ait sshd[2782535]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 09:22:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 09:22:18 ait sshd[2782441]: Invalid user toolineo-werkstatt.de 2a03 from 122.51.104.242 port 44638


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 09:22:19 ait sshd[2782441]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 09:22:19 ait sshd[2782441]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-22.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.158.243.50
description:
2025-01-27 09:24:09 dovecot_login authenticator failed for ([117.158.243.50]) [117.158.243.50]:37726: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.146.113.86
description:
[2025-01-27 09:24:29 +0100] info [webmaild] 185.146.113.86 - postmaster@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 27 09:24:39 ait sshd[2783253]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.158.243.50
description:
Jan 27 09:24:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.158.243.50 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 27 09:24:39 ait sshd[2783253]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 09:24:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 09:24:50 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (prous) [51.255.84.180]:39748: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 27 09:25:35 ait sshd[2783703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.211
description:
Jan 27 09:25:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.211
description:
2025-01-27 09:25:44 dovecot_login authenticator failed for ([195.178.110.211]) [195.178.110.211]:60595: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 27 09:25:35 ait sshd[2783703]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.190
description:
2025-01-27 09:26:34 dovecot_plain authenticator failed for (lited) [2.110.10.190]:59416: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 27 09:26:41 ait sshd[2784313]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-27 09:26:47 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (factitinis) [51.255.84.180]:50456: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.218.28.118
description:
2025-01-27 09:26:49 dovecot_login authenticator failed for (cpe-c83a353b2048.cpe.cableonda.net) [190.218.28.118]:57230: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 27 09:26:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.190
description:
Jan 27 09:26:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.190 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 27 09:26:41 ait sshd[2784313]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 27 09:26:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.218.28.118
description:
Jan 27 09:26:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.218.28.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-27 09:26:58 dovecot_login authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:54818: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 27 09:27:14 ait sshd[2784627]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.133
description:
Jan 27 09:27:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.133 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 09:27:51 ait sshd[2784742]: Invalid user envergure224.com 2a00 from 111.231.56.128 port 59316


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 09:27:51 ait sshd[2784742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 27 09:27:14 ait sshd[2784627]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.141.194.159
description:
2025-01-27 09:27:19 dovecot_plain authenticator failed for ([121.141.194.159]) [121.141.194.159]:55944: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-27 09:27:25 dovecot_plain authenticator failed for (blenner) [37.224.119.19]:43302: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.133
description:
2025-01-27 09:27:46 dovecot_login authenticator failed for ([103.152.234.133]) [103.152.234.133]:36654: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-27 09:27:30 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:57994: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 09:27:51 ait sshd[2784742]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.108.51
description:
2025-01-27 09:27:30 dovecot_plain authenticator failed for (ovousighea) [95.79.108.51]:53577: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.141.194.159
description:
Jan 27 09:27:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.141.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 27 09:27:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.108.51
description:
Jan 27 09:27:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.108.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 27 09:27:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.8
description:
2025-01-27 09:28:00 dovecot_login authenticator failed for (nsg-corporate-8.229.187.122.airtel.in) [122.187.229.8]:42017: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.144.33.209
description:
Jan 27 09:28:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.144.33.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
description:
2025-01-27 09:28:33 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:56944: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.8
description:
Jan 27 09:27:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 27 09:28:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-27 09:28:12 dovecot_plain authenticator failed for (twinate) [89.23.210.188]:43387: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.90.227.255
description:
Jan 27 09:28:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.90.227.255 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.227.255
description:
2025-01-27 09:28:45 dovecot_login authenticator failed for syn-172-090-227-255.res.spectrum.com [172.90.227.255]:46942: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.178.43
description:
2025-01-27 09:29:52 dovecot_plain authenticator failed for ([188.59.178.43]) [188.59.178.43]:56725: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Jan 27 09:29:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 09:29:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
description:
2025-01-27 09:29:40 dovecot_plain authenticator failed for ([112.196.52.107]) [112.196.52.107]:56010: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.216.198.213
description:
Jan 27 09:29:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.216.198.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.234.106.216
description:
2025-01-27 09:29:13 dovecot_plain authenticator failed for (201-234-106-216.static.impsat.net.ar) [201.234.106.216]:47531: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.216.198.213
description:
2025-01-27 09:29:15 dovecot_plain authenticator failed for c-84-216-198-213.bbcust.telenor.se (unceny) [84.216.198.213]:46566: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-01-27 09:29:58 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:46120: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Jan 27 09:29:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-01-27 09:29:25 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl (quity) [188.127.16.197]:58228: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.178.43
description:
Jan 27 09:29:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.178.43 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 09:29:46 ait sshd[2785475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 27 09:29:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-01-27 09:29:02 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:39168: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.234.106.216
description:
Jan 27 09:29:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.234.106.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.52.107
description:
Jan 27 09:29:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.52.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 27 09:29:46 ait sshd[2785475]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Jan 27 09:29:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Jan 27 09:29:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-29.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-01-27 09:29:32 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:56582: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-27 09:29:51 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:51172: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
description:
Jan 27 09:30:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 27 09:30:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
description:
Jan 27 09:30:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.61
description:
Jan 27 09:30:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
description:
2025-01-27 09:30:42 dovecot_login authenticator failed for ([91.73.195.150]) [91.73.195.150]:41905: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 27 09:30:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 09:30:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.61
description:
2025-01-27 09:30:43 dovecot_login authenticator failed for (m121-202-155-61.smartone.com) [121.202.155.61]:49582: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-27 09:30:54 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:35199: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-27 09:30:57 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:30276: 535 Incorrect authentication data (set_id=sales)


