# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.28.167.27
description:
Jan 30 09:11:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.28.167.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.43.220
description:
[2025-01-30 09:11:21 +0100] info [whostmgrd] 104.207.43.220 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.89.241
description:
[2025-01-30 09:11:21 +0100] info [whostmgrd] 156.228.89.241 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.52
description:
[2025-01-30 09:11:19 +0100] info [cpaneld] 156.228.118.52 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 30 09:11:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.122
description:
[2025-01-30 09:11:22 +0100] info [whostmgrd] 104.207.53.122 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.52.83
description:
[2025-01-30 09:11:23 +0100] info [whostmgrd] 104.207.52.83 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.28.167.27
description:
2025-01-30 09:11:44 dovecot_plain authenticator failed for (hablets) [89.28.167.27]:65148: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.183.182.3
description:
[2025-01-30 09:11:54 +0100] info [webmaild] 45.183.182.3 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 30 09:11:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.58.47
description:
[2025-01-30 09:11:16 +0100] info [cpaneld] 104.207.58.47 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00244y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.112.207
description:
[2025-01-30 09:11:17 +0100] info [cpaneld] 156.228.112.207 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.109.214
description:
[2025-01-30 09:11:19 +0100] info [cpaneld] 156.228.109.214 - ads20a00244y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00244y (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-30 09:12:01 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:50867: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 09:12:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.233.246
description:
2025-01-30 09:13:01 dovecot_plain authenticator failed for ([221.149.233.246]) [221.149.233.246]:55049: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 30 09:13:05 ait sshd[787045]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.123.136
description:
47.128.123.136 - - [30/Jan/2025:09:12:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13762618 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=125%2C205&filter_course-language=118%2C79%2C95%2C121&price_type=paid&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.123.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.233.246
description:
Jan 30 09:12:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.233.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 30 09:13:05 ait sshd[787045]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 09:13:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.161
description:
2025-01-30 09:13:11 dovecot_plain authenticator failed for (nlos-200-161.zamnet.zm) [196.46.200.161]:38921: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.71.6.31
description:
Jan 30 09:13:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.71.6.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.71.6.31
description:
2025-01-30 09:13:28 dovecot_login authenticator failed for ([127.0.0.1]) [178.71.6.31]:42464: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-01-30 09:13:52 dovecot_plain authenticator failed for ([92.126.223.175]) [92.126.223.175]:60352: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 09:13:24 ait sshd[787119]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Jan 30 09:13:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.161
description:
Jan 30 09:13:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.237.145.238
description:
Jan 30 09:13:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.237.145.238 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 09:13:24 ait sshd[787119]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.237.145.238
description:
2025-01-30 09:13:38 dovecot_login authenticator failed for ([127.0.0.1]) [171.237.145.238]:5247: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
description:
Jan 30 09:14:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
description:
2025-01-30 09:14:07 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:47015: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.15.247.247
description:
[2025-01-30 09:14:16 +0100] info [webmaild] 103.15.247.247 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.90.99.29
description:
2025-01-30 09:14:18 dovecot_plain authenticator failed for ([70.90.99.29]) [70.90.99.29]:33476: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.10.125.106
description:
2025-01-30 09:14:29 dovecot_plain authenticator failed for (106.host.advance.com.ar) [200.10.125.106]:62501: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.118.229.174
description:
[2025-01-30 09:15:03 +0100] info [webmaild] 181.118.229.174 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.161.147.94
description:
[2025-01-30 09:15:08 +0100] info [webmaild] 45.161.147.94 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.90.99.29
description:
Jan 30 09:14:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.90.99.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.10.125.106
description:
Jan 30 09:14:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.10.125.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 30 09:14:31 ait sshd[787563]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 30 09:14:31 ait sshd[787563]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.164.202.218
description:
Jan 30 09:16:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.164.202.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.225.207.166
description:
Jan 30 09:16:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.225.207.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.225.207.166
description:
2025-01-30 09:16:32 dovecot_plain authenticator failed for ([111.225.207.166]) [111.225.207.166]:39809: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 09:15:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.130.184.144
description:
[2025-01-30 09:16:00 +0100] info [webmaild] 177.130.184.144 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.164.202.218
description:
2025-01-30 09:16:20 dovecot_plain authenticator failed for ([61.164.202.219]) [61.164.202.218]:21648: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 30 09:17:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-01-30 09:17:30 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:34586: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.46.203.210
description:
Jan 30 09:17:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.46.203.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.46.203.210
description:
2025-01-30 09:17:40 dovecot_plain authenticator failed for ([211.46.203.210]) [211.46.203.210]:51304: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.164.94.190
description:
Jan 30 09:17:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.164.94.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.164.94.190
description:
2025-01-30 09:18:00 dovecot_plain authenticator failed for ([39.164.94.190]) [39.164.94.190]:52544: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.4
description:
Jan 30 09:18:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.69.115.74
description:
Jan 30 09:18:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.69.115.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 30 09:17:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.174.147
description:
Jan 30 09:17:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.174.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.139.102.153
description:
2025-01-30 09:17:56 dovecot_plain authenticator failed for ([144.139.102.153]) [144.139.102.153]:58834: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-30 09:18:29 dovecot_login authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:48526: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 30 09:18:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-30 09:18:23 dovecot_plain authenticator failed for ([218.22.187.70]) [218.22.187.66]:55489: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.139.102.153
description:
Jan 30 09:17:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.139.102.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.213.230.119
description:
[2025-01-30 09:17:58 +0100] info [webmaild] 185.213.230.119 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.4
description:
2025-01-30 09:18:12 dovecot_plain authenticator failed for ([2.55.85.4]) [2.55.85.4]:44938: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.69.115.74
description:
2025-01-30 09:18:13 dovecot_login authenticator failed for ([218.69.115.74]) [218.69.115.74]:33651: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 30 09:18:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-30 09:17:43 dovecot_login authenticator failed for ([118.70.240.36]) [118.70.240.37]:36573: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.174.147
description:
2025-01-30 09:17:51 dovecot_plain authenticator failed for (unknown.bwdc.fsg.ordnance.co) [103.79.174.147]:37150: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.236.104.248
description:
[2025-01-30 09:18:45 +0100] info [webmaild] 45.236.104.248 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.217.186
description:
[2025-01-30 09:18:56 +0100] info [webmaild] 143.255.217.186 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 30 09:19:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.45.57
description:
Jan 30 09:19:30 ait sshd[789718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.45.57


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-19.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-30 09:19:26 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:55358: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.53.120.97
description:
2025-01-30 09:19:46 dovecot_plain authenticator failed for v2202501250131308547.bestsrv.de [152.53.120.97]:51360: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.127.98
description:
[2025-01-30 09:19:48 +0100] info [webmaild] 170.245.127.98 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
description:
2025-01-30 09:20:26 dovecot_plain authenticator failed for (recess) [65.20.149.93]:60078: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.53.120.97
description:
Jan 30 09:19:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.53.120.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-01-30 09:20:25 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:35786: 535 Incorrect authentication data (set_id=ampofo)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-20.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 30 09:19:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-30 09:19:43 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:59581: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
description:
2025-01-30 09:20:13 dovecot_login authenticator failed for ([50.188.204.213]) [50.188.204.213]:38919: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.149.93
description:
Jan 30 09:20:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.149.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
description:
Jan 30 09:20:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
description:
2025-01-30 09:20:26 dovecot_plain authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:55536: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.172.239.193
description:
Jan 30 09:19:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.172.239.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.172.239.193
description:
2025-01-30 09:19:53 dovecot_plain authenticator failed for sed08-h03-176-172-239-193.dsl.sta.abo.bbox.fr [176.172.239.193]:61845: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.188.204.213
description:
Jan 30 09:20:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.188.204.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.248.31.142
description:
Jan 30 09:20:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.248.31.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 09:21:10 ait sshd[790777]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 09:21:10 ait sshd[790777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.167.89
description:
Jan 30 09:21:17 ait sshd[790802]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.167.89


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.77.20
description:
Jan 30 09:20:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.77.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.77.20
description:
2025-01-30 09:20:44 dovecot_plain authenticator failed for ([211.228.77.20]) [211.228.77.20]:33208: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.167.89
description:
Jan 30 09:21:17 ait sshd[790802]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.136.87.130
description:
Jan 30 09:22:36 ait sshd[791137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.136.87.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.7.203.238
description:
[2025-01-30 09:22:39 +0100] info [webmaild] 191.7.203.238 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.167.59
description:
2025-01-30 09:22:40 dovecot_plain authenticator failed for ([111.39.167.59]) [111.39.167.59]:58812: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 47.128.23.17
description:
47.128.23.17 - - [30/Jan/2025:09:21:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5364003 HTTP/2.0" 404 150 lms.aitsmartschool.com "-" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.23.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-30 09:22:34 dovecot_plain authenticator failed for (bastnes) [46.30.161.197]:59445: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 30 09:22:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.167.59
description:
Jan 30 09:22:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.167.59 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.172.9.13
description:
[2025-01-30 09:21:59 +0100] info [webmaild] 152.172.9.13 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.97.81
description:
47.128.97.81 - - [30/Jan/2025:09:22:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22607763 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=453" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.97.81


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.136.87.130
description:
Jan 30 09:22:36 ait sshd[791137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.136.87.130


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Jan 30 09:22:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.118.112.230
description:
Jan 30 09:23:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.118.112.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.121.4
description:
[2025-01-30 09:22:45 +0100] info [webmaild] 177.221.121.4 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-30 09:22:52 dovecot_plain authenticator failed for ([144.48.49.72]) [144.48.49.72]:33336: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.118.112.230
description:
2025-01-30 09:23:39 dovecot_plain authenticator failed for syn-070-118-112-230.biz.spectrum.com [70.118.112.230]:45266: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.159.35
description:
[2025-01-30 09:23:32 +0100] info [webmaild] 45.163.159.35 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 30 09:23:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.174.45
description:
Jan 30 09:24:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.174.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 30 09:24:10 ait sshd[791837]: pam_imunify(sshd:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 30 09:24:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.44.191
description:
Jan 30 09:23:50 ait sshd[791593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.44.191


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.174.45
description:
2025-01-30 09:24:07 dovecot_plain authenticator failed for ([37.204.174.45]) [37.204.174.45]:53788: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.111.64.38
description:
2025-01-30 09:24:16 dovecot_plain authenticator failed for ([176.111.64.38]) [176.111.64.38]:44901: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-30 09:24:37 dovecot_plain authenticator failed for ([203.252.10.3]) [203.252.10.3]:16833: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-30 09:23:47 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:46284: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.44.191
description:
Jan 30 09:23:50 ait sshd[791593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.44.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.111.64.38
description:
Jan 30 09:24:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.111.64.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.38.70.172
description:
Jan 30 09:24:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.38.70.172 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 220.80.223.144
description:
Jan 30 09:24:10 ait sshd[791837]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.80.223.144


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.38.70.172
description:
2025-01-30 09:24:26 dovecot_plain authenticator failed for ([110.38.70.172]) [110.38.70.172]:16960: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.45.57
description:
Jan 30 09:25:04 ait sshd[792293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.45.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-30 09:25:19 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:12508: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.133
description:
2025-01-30 09:24:52 dovecot_login authenticator failed for ([103.152.234.133]) [103.152.234.133]:54064: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.133
description:
Jan 30 09:24:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 30 09:25:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.189.28.43
description:
[2025-01-30 09:26:00 +0100] info [webmaild] 187.189.28.43 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.227.21
description:
Jan 30 09:26:27 ait sshd[793033]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.92.227.21 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.10.45.57
description:
Jan 30 09:26:40 ait sshd[793105]: Failed password for invalid user nmr from 103.10.45.57 port 38562 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.92.227.21
description:
Jan 30 09:26:27 ait sshd[793033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.92.227.21


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 220.80.223.144
description:
Jan 30 09:26:36 ait sshd[793091]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.80.223.144


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.114.229
description:
Jan 30 09:26:22 ait sshd[793012]: pam_imunify(sshd:auth): [IM360_RBL] The IP 47.180.114.229 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.167.89
description:
Jan 30 09:26:30 ait sshd[793046]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.167.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.100.90
description:
2025-01-30 09:25:50 dovecot_login authenticator failed for ([127.0.0.1]) [27.223.100.90]:34662: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.180.114.229
description:
Jan 30 09:26:22 ait sshd[793012]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.44.224
description:
47.128.44.224 - - [30/Jan/2025:09:26:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14758649 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=964" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.44.224


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.10.45.57
description:
Jan 30 09:26:39 ait sshd[793105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.45.57


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.180.46.58
description:
2025-01-30 09:25:59 dovecot_login authenticator failed for ([127.0.0.1]) [113.180.46.58]:37278: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 30 09:26:36 ait sshd[793091]: pam_imunify(sshd:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.167.89
description:
Jan 30 09:26:30 ait sshd[793046]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-01-30 09:27:35 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:44586: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.124.167.89
description:
Jan 30 09:27:37 ait sshd[793515]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.124.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.10.45.57
description:
Jan 30 09:26:42 ait sshd[793105]: Disconnected from invalid user nmr 103.10.45.57 port 38562 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.225.57.8
description:
[2025-01-30 09:27:04 +0100] info [webmaild] 186.225.57.8 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.124.167.89
description:
Jan 30 09:27:37 ait sshd[793515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.124.167.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.41.171
description:
2025-01-30 09:27:26 dovecot_plain authenticator failed for 171.41.246.220.static.netvigator.com [220.246.41.171]:56523: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 09:27:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.41.171
description:
Jan 30 09:27:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.106.42.209
description:
[2025-01-30 09:26:46 +0100] info [webmaild] 91.106.42.209 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.222.137.41
description:
Jan 30 09:27:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.222.137.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-01-30 09:27:45 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:48860: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 30 09:28:00 ait sshd[793844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.44.191
description:
Jan 30 09:28:28 ait sshd[794030]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.44.191 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.175.52.251
description:
[2025-01-30 09:27:45 +0100] info [webmaild] 201.175.52.251 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 30 09:28:08 ait sshd[793863]: pam_imunify(sshd:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.44.191
description:
Jan 30 09:28:28 ait sshd[794030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.44.191


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
description:
Jan 30 09:27:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 30 09:28:00 ait sshd[793844]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 220.80.223.144
description:
Jan 30 09:28:08 ait sshd[793863]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.80.223.144


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.182.161.206
description:
Jan 30 09:29:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.182.161.206 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads19a00014y||WPU:ads19a00014y||RSV:6.65||T:APACHE||MV:09-29.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.182.161.206
description:
2025-01-30 09:29:20 dovecot_plain authenticator failed for ([103.182.161.206]) [103.182.161.206]:44676: 535 Incorrect authentication data (set_id=ads09a99049y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 09:30:34 ait sshd[794720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.92.227.21
description:
Jan 30 09:30:37 ait sshd[794722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.92.227.21


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.224.179.25
description:
[2025-01-30 09:30:11 +0100] info [webmaild] 91.224.179.25 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.96.44.191
description:
Jan 30 09:30:09 ait sshd[794651]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.96.44.191


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.178.198.246
description:
2025-01-30 09:30:08 dovecot_plain authenticator failed for (CPC-julio-TZJH0.jyryzpb1cmhunjthwf2kz0ni3f.fx.internal.cloudapp.net) [52.178.198.246]:3796: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 09:30:34 ait sshd[794720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.227.21
description:
Jan 30 09:30:37 ait sshd[794722]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.92.227.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.254.98
description:
Jan 30 09:29:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.254.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.254.98
description:
2025-01-30 09:29:46 dovecot_plain authenticator failed for ([220.124.254.98]) [220.124.254.98]:55646: 535 Incorrect authentication data (set_id=ads09a99049y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.96.44.191
description:
Jan 30 09:30:09 ait sshd[794651]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.96.44.191 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.249.51.83
description:
[2025-01-30 09:31:38 +0100] info [webmaild] 152.249.51.83 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.178.198.246
description:
2025-01-30 09:30:41 dovecot_login authenticator failed for (CPC-julio-TZJH0.jyryzpb1cmhunjthwf2kz0ni3f.fx.internal.cloudapp.net) [52.178.198.246]:6050: 535 Incorrect authentication data (set_id=ads23b00195y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.239.211
description:
[2025-01-30 09:30:42 +0100] info [webmaild] 143.208.239.211 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 30 09:30:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.129.122.185
description:
Jan 30 09:30:54 ait sshd[794776]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.129.122.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-30 09:30:56 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:61893: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 09:31:03 ait sshd[794770]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.67.79.165
description:
Jan 30 09:30:41 ait sshd[794729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.67.79.165


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.0.189.18
description:
[2025-01-30 09:31:01 +0100] info [webmaild] 194.0.189.18 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.180.114.229
description:
Jan 30 09:31:13 ait sshd[795088]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.129.122.185
description:
Jan 30 09:30:54 ait sshd[794776]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.129.122.185 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 09:31:03 ait sshd[794770]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.114.229
description:
Jan 30 09:31:13 ait sshd[795088]: pam_imunify(sshd:auth): [IM360_RBL] The IP 47.180.114.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
description:
2025-01-30 09:32:13 dovecot_login authenticator failed for ([183.182.99.92]) [183.182.99.92]:39507: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.114.229
description:
Jan 30 09:32:26 ait sshd[795578]: pam_imunify(sshd:auth): [IM360_RBL] The IP 47.180.114.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.109
description:
2025-01-30 09:32:38 dovecot_login authenticator failed for 111-70-49-109.emome-ip.hinet.net [111.70.49.109]:60446: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.201.6
description:
Jan 30 09:31:56 ait sshd[795347]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.201.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-30 09:31:58 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:33078: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.180.114.229
description:
Jan 30 09:32:26 ait sshd[795578]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.180.114.229


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.109
description:
Jan 30 09:32:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.109 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 30 09:31:43 ait sshd[795274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 30 09:31:43 ait sshd[795274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.201.6
description:
Jan 30 09:31:56 ait sshd[795347]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.201.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 30 09:31:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.182.99.92
description:
Jan 30 09:32:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.182.99.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.148.10
description:
Jan 30 09:32:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.148.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
description:
2025-01-30 09:32:51 dovecot_login authenticator failed for (hebei.18.121.in-addr.arpa) [121.18.148.10]:20130: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 09:33:11 ait sshd[795904]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-33.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.43.232.65
description:
Jan 30 09:32:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.43.232.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.92.227.21
description:
Jan 30 09:33:12 ait sshd[795910]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.92.227.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-01-30 09:33:18 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:42286: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
description:
2025-01-30 09:33:09 dovecot_login authenticator failed for ([111.61.177.188]) [111.61.177.188]:31972: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 30 09:33:11 ait sshd[795904]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.54.3.2
description:
2025-01-30 09:32:46 dovecot_login authenticator failed for ([182.54.3.2]) [182.54.3.2]:47643: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.43.232.65
description:
2025-01-30 09:32:54 dovecot_login authenticator failed for (DGV-gw.transtelecom.net) [188.43.232.65]:55188: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.156.137.103
description:
Jan 30 09:32:59 ait sshd[795720]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.156.137.103  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
description:
Jan 30 09:33:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.92.227.21
description:
Jan 30 09:33:12 ait sshd[795910]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.92.227.21


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.54.3.2
description:
Jan 30 09:32:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.54.3.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.156.137.103
description:
Jan 30 09:32:59 ait sshd[795720]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.156.137.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Jan 30 09:33:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-01-30 09:34:13 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:52483: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 30 09:34:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-30 09:34:24 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:53836: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 09:33:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.104.221.252
description:
Jan 30 09:33:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.104.221.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.72.74
description:
[2025-01-30 09:34:13 +0100] info [webmaild] 38.156.72.74 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-30 09:34:12 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:57358: 535 Incorrect authentication data (set_id=ads21a00042y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
description:
2025-01-30 09:34:33 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:36032: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 09:34:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 09:33:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 30 09:34:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.226.68
description:
2025-01-30 09:34:24 H=(mail.lemass.net) [165.154.226.68]:62628 F=<uhyfowkk@lemass.net> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
description:
Jan 30 09:34:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.221.252
description:
2025-01-30 09:34:01 dovecot_plain authenticator failed for ([210.104.221.252]) [210.104.221.252]:55063: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
description:
Jan 30 09:34:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.131.55
description:
2025-01-30 09:34:10 dovecot_login authenticator failed for (abts-mum-static-055.131.179.122.airtelbroadband.in) [122.179.131.55]:43864: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.4
description:
Jan 30 09:34:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.204.25.156
description:
[2025-01-30 09:34:50 +0100] info [webmaild] 94.204.25.156 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.64.10
description:
Jan 30 09:35:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.64.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
description:
2025-01-30 09:35:04 dovecot_login authenticator failed for ([121.178.185.141]) [121.178.185.141]:38356: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 09:35:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 30 09:34:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.170.255.126
description:
Jan 30 09:34:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.170.255.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.4
description:
2025-01-30 09:34:47 dovecot_plain authenticator failed for ([2.55.85.4]) [2.55.85.4]:35804: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-01-30 09:34:47 dovecot_login authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:58042: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.170.255.126
description:
2025-01-30 09:34:48 dovecot_plain authenticator failed for ([222.170.255.126]) [222.170.255.126]:53624: 535 Incorrect authentication data (set_id=eng20b00207y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
description:
Jan 30 09:35:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.12.70.32
description:
[2025-01-30 09:35:03 +0100] info [webmaild] 189.12.70.32 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-30 09:35:03 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:53406: 535 Incorrect authentication data (set_id=eng20b00207y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.201.6
description:
Jan 30 09:35:19 ait sshd[796849]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.201.6


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.67.79.165
description:
Jan 30 09:35:08 ait sshd[796801]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.67.79.165


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.201.6
description:
Jan 30 09:35:19 ait sshd[796849]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.201.6 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 192.169.201.6
description:
Jan 30 09:36:36 ait sshd[797487]: Failed password for invalid user odoo15 from 192.169.201.6 port 58788 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.34.225.151
description:
[2025-01-30 09:35:47 +0100] info [webmaild] 193.34.225.151 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.169.201.6
description:
Jan 30 09:36:33 ait sshd[797487]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.169.201.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.169.201.6
description:
Jan 30 09:36:33 ait sshd[797487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.169.201.6


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.129.122.185
description:
Jan 30 09:35:40 ait sshd[796885]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.129.122.185 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.129.122.185
description:
Jan 30 09:35:40 ait sshd[796885]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.129.122.185


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
description:
Jan 30 09:37:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.165.251
description:
Jan 30 09:37:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.165.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.28.125.96
description:
Jan 30 09:37:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.28.125.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 30 09:37:38 ait sshd[797930]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.129.122.185
description:
Jan 30 09:37:12 ait sshd[797846]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.129.122.185


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-01-30 09:37:17 dovecot_plain authenticator failed for ([121.202.152.165]) [121.202.152.165]:10143: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.165.251
description:
2025-01-30 09:37:23 dovecot_plain authenticator failed for ([211.178.165.251]) [211.178.165.251]:37473: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.28.125.96
description:
2025-01-30 09:37:26 dovecot_plain authenticator failed for ([38.28.125.96]) [38.28.125.96]:60028: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.67.79.165
description:
Jan 30 09:36:43 ait sshd[797583]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.67.79.165  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.254.162
description:
Jan 30 09:37:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.254.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 09:37:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.129.122.185
description:
Jan 30 09:37:12 ait sshd[797846]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.129.122.185 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 09:37:38 ait sshd[797930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.71.254.162
description:
2025-01-30 09:37:09 dovecot_plain authenticator failed for ([223.71.254.162]) [223.71.254.162]:48687: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 09:37:56 ait sshd[798049]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.129.208.51
description:
[2025-01-30 09:38:08 +0100] info [webmaild] 103.129.208.51 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 205.196.221.238
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-38.205.196.221.238


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 09:37:56 ait sshd[798049]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.160.168
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-38.157.230.160.168


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 09:38:18 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
description:
Jan 30 09:38:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
description:
2025-01-30 09:38:46 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:39206: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.47.189.207
description:
[2025-01-30 09:38:49 +0100] info [webmaild] 95.47.189.207 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.226.5
description:
[2025-01-30 09:39:09 +0100] info [webmaild] 45.180.226.5 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 52.178.198.246
description:
Jan 30 09:39:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 52.178.198.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.87.34.133
description:
Jan 30 09:39:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.87.34.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.87.34.133
description:
2025-01-30 09:39:33 dovecot_plain authenticator failed for syn-023-087-034-133.res.spectrum.com [23.87.34.133]:48622: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 52.178.198.246
description:
2025-01-30 09:39:15 dovecot_plain authenticator failed for (CPC-julio-TZJH0.jyryzpb1cmhunjthwf2kz0ni3f.fx.internal.cloudapp.net) [52.178.198.246]:1615: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.110.194
description:
Jan 30 09:39:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.110.194 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 34.236.49.28
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:09-40.34.236.49.28


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.126.100
description:
47.128.126.100 - - [30/Jan/2025:09:40:29 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4198043 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/2ddaf9?panel=config" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.126.100


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.81
description:
[2025-01-30 09:39:44 +0100] info [webmaild] 213.230.86.81 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.110.194
description:
2025-01-30 09:39:53 dovecot_login authenticator failed for host194.sub-63-46-110.myvzw.com [63.46.110.194]:58222: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-30 09:40:24 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:47879: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 30 09:40:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-30 09:40:36 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:1541: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.239.109.147
description:
Jan 30 09:40:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.239.109.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.239.109.147
description:
2025-01-30 09:40:07 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:55438: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 30 09:40:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 2.57.122.188
description:
Jan 30 09:40:54 ait sshd[799230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=2.57.122.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.21.254.67
description:
Jan 30 09:41:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.21.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.21.254.67
description:
2025-01-30 09:41:19 dovecot_login authenticator failed for ([127.0.0.1]) [37.21.254.67]:53708: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
description:
2025-01-30 09:41:22 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:56909: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.6.198.208
description:
2025-01-30 09:41:27 dovecot_login authenticator failed for ([127.0.0.1]) [67.6.198.208]:43796: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 09:41:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.234.48.147
description:
Jan 30 09:41:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.234.48.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-30 09:40:48 dovecot_login authenticator failed for ([2.57.219.6]) [2.57.219.2]:46468: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 30 09:40:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-30 09:40:50 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:59010: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.122.188
description:
Jan 30 09:40:54 ait sshd[799230]: pam_imunify(sshd:auth): [IM360_RBL] The IP 2.57.122.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.90.204.17
description:
Jan 30 09:41:14 ait sshd[799560]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.90.204.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 09:41:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 30 09:40:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.184.18
description:
2025-01-30 09:41:08 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:60693: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.222.184.18
description:
Jan 30 09:41:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.222.184.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.24.137.112
description:
Jan 30 09:41:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.24.137.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.169.232
description:
Jan 30 09:42:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.169.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.24.137.112
description:
2025-01-30 09:42:01 dovecot_login authenticator failed for ([127.0.0.1]) [123.24.137.112]:59894: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.0.252
description:
[2025-01-30 09:42:08 +0100] info [webmaild] 177.221.0.252 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.169.232
description:
2025-01-30 09:42:10 dovecot_login authenticator failed for ([127.0.0.1]) [117.253.169.232]:34496: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 30 09:41:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-30 09:41:46 dovecot_login authenticator failed for (ppp-82-84-122-203.dialup.tiscali.it) [82.84.122.203]:62689: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.170.237
description:
Jan 30 09:41:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.170.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.170.237
description:
2025-01-30 09:41:58 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.170.237]:57008: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 09:42:46 ait sshd[800193]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.89.39.209
description:
[2025-01-30 09:42:59 +0100] info [webmaild] 181.89.39.209 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.209.125.56
description:
[2025-01-30 09:43:06 +0100] info [webmaild] 179.209.125.56 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 30 09:42:46 ait sshd[800193]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.82.131.20
description:
Jan 30 09:44:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.82.131.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 09:44:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.178.191.66
description:
[2025-01-30 09:44:13 +0100] info [webmaild] 103.178.191.66 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Jan 30 09:44:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-01-30 09:44:28 dovecot_login authenticator failed for (m121-202-197-86.smartone.com) [121.202.197.86]:18116: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 09:45:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.87.228
description:
Jan 30 09:45:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.87.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.70.240.37
description:
Jan 30 09:45:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.70.240.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.95.114.242
description:
Jan 30 09:44:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.95.114.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.95.114.242
description:
2025-01-30 09:44:48 dovecot_login authenticator failed for (242.114.95.187.static.liggatelecom.com.br) [187.95.114.242]:1160: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Jan 30 09:44:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-01-30 09:44:53 dovecot_plain authenticator failed for (reism) [65.20.155.91]:39851: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.244
description:
2025-01-30 09:45:16 dovecot_login authenticator failed for ([123.214.65.244]) [123.214.65.244]:35222: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.70.240.37
description:
2025-01-30 09:45:26 dovecot_login authenticator failed for ([118.70.240.37]) [118.70.240.37]:34841: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.82.131.20
description:
2025-01-30 09:44:41 dovecot_login authenticator failed for ([184.82.131.20]) [184.82.131.20]:55300: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.244
description:
Jan 30 09:45:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.87.228
description:
2025-01-30 09:45:26 dovecot_login authenticator failed for s2.legionusa.com [159.203.87.228]:59704: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-01-30 09:45:46 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:50320: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 30 09:45:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-30 09:45:53 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:37851: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-01-30 09:46:05 dovecot_login authenticator failed for ([175.210.74.19]) [175.210.74.19]:34988: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.179.54.132
description:
[2025-01-30 09:46:11 +0100] info [webmaild] 201.179.54.132 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 09:46:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Jan 30 09:45:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.30.104
description:
Jan 30 09:46:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.30.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.30.104
description:
2025-01-30 09:46:25 dovecot_login authenticator failed for 83-233-30-104.cust.bredband2.com [83.233.30.104]:53482: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Jan 30 09:46:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 30 09:47:03 ait sshd[801990]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.136.142.13
description:
Jan 30 09:47:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.136.142.13 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.235.221
description:
[2025-01-30 09:47:01 +0100] info [webmaild] 177.221.235.221 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 09:47:03 ait sshd[801990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.136.142.13
description:
2025-01-30 09:47:11 dovecot_login authenticator failed for ([61.136.142.13]) [61.136.142.13]:1092: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.0.179.17
description:
[2025-01-30 09:47:18 +0100] info [webmaild] 188.0.179.17 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-47.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 30 09:47:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-30 09:47:32 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:34122: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.148.0.202
description:
2025-01-30 09:47:56 dovecot_plain authenticator failed for syn-131-148-000-202.biz.spectrum.com [131.148.0.202]:53694: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 30 09:48:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-30 09:48:17 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:33260: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.78
description:
Jan 30 09:48:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.78
description:
2025-01-30 09:48:05 dovecot_plain authenticator failed for (nsg-corporate-78.229.187.122.airtel.in) [122.187.229.78]:47385: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.77.78.97
description:
[2025-01-30 09:48:11 +0100] info [webmaild] 37.77.78.97 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.148.0.202
description:
Jan 30 09:47:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.148.0.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Jan 30 09:47:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
description:
2025-01-30 09:48:01 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:40950: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.15.251.33
description:
Jan 30 09:48:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.15.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.15.251.33
description:
2025-01-30 09:48:43 dovecot_plain authenticator failed for ([59.15.251.33]) [59.15.251.33]:60392: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Jan 30 09:49:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-01-30 09:49:03 dovecot_login authenticator failed for ([127.0.0.1]) [203.172.213.166]:33837: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.90.204.17
description:
Jan 30 09:48:49 ait sshd[802562]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.90.204.17


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.72.147.10
description:
Jan 30 09:49:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.72.147.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.72.147.10
description:
2025-01-30 09:49:02 dovecot_plain authenticator failed for ([180.166.163.26]) [222.72.147.10]:42088: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.244.231.239
description:
Jan 30 09:49:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.244.231.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.244.231.239
description:
2025-01-30 09:49:17 dovecot_login authenticator failed for ([127.0.0.1]) [120.244.231.239]:45140: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.109.20.192
description:
2025-01-30 09:49:59 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:45726: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.113
description:
2025-01-30 09:50:14 dovecot_login authenticator failed for ([103.190.91.113]) [103.190.91.113]:59356: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 30 09:50:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-30 09:50:21 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:58098: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.169.81.36
description:
Jan 30 09:50:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.169.81.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-30 09:50:17 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:40110: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.174.197.18
description:
[2025-01-30 09:50:25 +0100] info [webmaild] 85.174.197.18 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Jan 30 09:50:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 30 09:50:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-49.157.230.172.131


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-49.147.135.223.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 09:49:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.169.81.36
description:
2025-01-30 09:50:07 dovecot_plain authenticator failed for syn-076-169-081-036.res.spectrum.com [76.169.81.36]:54998: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-30 09:50:14 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:49620: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-01-30 09:50:30 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:58160: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.109.20.192
description:
Jan 30 09:49:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.109.20.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 30 09:50:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.113
description:
Jan 30 09:50:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.222.80.77
description:
Jan 30 09:51:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.222.80.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.138
description:
2025-01-30 09:50:43 dovecot_plain authenticator failed for ([116.124.241.138]) [116.124.241.138]:49458: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 30 09:51:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-30 09:51:07 dovecot_plain authenticator failed for ([200.223.193.9]) [200.223.192.254]:38369: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.160
description:
Jan 30 09:51:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.119.45.39
description:
[2025-01-30 09:51:16 +0100] info [webmaild] 196.119.45.39 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.188.165.198
description:
2025-01-30 09:51:32 dovecot_login authenticator failed for ([202.188.165.198]) [202.188.165.198]:58816: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.138
description:
Jan 30 09:50:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.160
description:
2025-01-30 09:51:17 dovecot_plain authenticator failed for (nsg-corporate-160.229.187.122.airtel.in) [122.187.229.160]:59860: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.122.100.197
description:
[2025-01-30 09:51:22 +0100] info [webmaild] 178.122.100.197 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.188.165.198
description:
Jan 30 09:51:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.188.165.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.222.80.77
description:
2025-01-30 09:51:38 dovecot_login authenticator failed for ([91.222.80.77]) [91.222.80.77]:37873: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Jan 30 09:51:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-01-30 09:51:47 dovecot_login authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:9393: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.27.32.70
description:
Jan 30 09:51:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.27.32.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.27.32.70
description:
2025-01-30 09:51:59 dovecot_login authenticator failed for syn-137-027-032-070.biz.spectrum.com [137.27.32.70]:44038: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.234.14.150
description:
[2025-01-30 09:52:16 +0100] info [webmaild] 179.234.14.150 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 09:52:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 30 09:54:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.14.233.108
description:
Jan 30 09:54:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.14.233.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-30 09:54:22 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:32992: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Jan 30 09:54:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.95.119.74
description:
Jan 30 09:54:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.95.119.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.137
description:
Jan 30 09:54:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.95.119.74
description:
2025-01-30 09:54:23 dovecot_login authenticator failed for ([127.0.0.1]) [212.95.119.74]:59487: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Jan 30 09:54:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.74.63.250
description:
[2025-01-30 09:54:11 +0100] info [cpaneld] 45.74.63.250 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-01-30 09:54:10 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:60604: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.14.233.108
description:
2025-01-30 09:54:12 dovecot_login authenticator failed for bb116-14-233-108.singnet.com.sg ([127.0.0.1]) [116.14.233.108]:59291: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.109.134.125
description:
[2025-01-30 09:54:22 +0100] info [webmaild] 95.109.134.125 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-30 09:54:11 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:61538: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 30 09:54:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.137
description:
2025-01-30 09:54:24 dovecot_login authenticator failed for ([103.106.154.137]) [103.106.154.137]:50363: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-01-30 09:54:33 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:63753: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Ads19a00014y||WPU:Ads19a00014y||RSV:6.65||T:APACHE||MV:09-54.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-01-30 09:54:45 dovecot_login authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:55632: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 09:54:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 30 09:55:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-30 09:55:03 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:56348: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 193.143.231.215
description:
[2025-01-30 09:55:30 +0100] info [webmaild] 193.143.231.215 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
description:
2025-01-30 09:54:47 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:54987: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-30 09:55:00 dovecot_login authenticator failed for ([222.114.200.160]) [222.114.200.160]:43207: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 30 09:55:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Jan 30 09:54:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 30 09:54:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.104.201.166
description:
[2025-01-30 09:55:13 +0100] info [webmaild] 190.104.201.166 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-30 09:55:18 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:34502: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
description:
Jan 30 09:54:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.134.94.201
description:
Jan 30 09:56:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.134.94.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
description:
Jan 30 09:56:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 30 09:56:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.188.165.198
description:
Jan 30 09:56:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.188.165.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.188.165.198
description:
2025-01-30 09:56:15 dovecot_login authenticator failed for ([202.188.165.198]) [202.188.165.198]:64732: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.44.133.167
description:
[2025-01-30 09:56:24 +0100] info [webmaild] 194.44.133.167 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 164.90.204.17
description:
Jan 30 09:56:26 ait sshd[805767]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=164.90.204.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.94.201
description:
2025-01-30 09:56:28 dovecot_plain authenticator failed for ([128.134.94.201]) [128.134.94.201]:42181: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-01-30 09:56:37 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:38888: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.170
description:
2025-01-30 09:55:59 dovecot_login authenticator failed for ([116.114.84.170]) [116.114.84.170]:48189: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 30 09:56:11 ait sshd[805556]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 09:55:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.170
description:
Jan 30 09:55:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-30 09:56:03 dovecot_login authenticator failed for ([144.48.49.68]) [144.48.49.68]:56415: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.187
description:
2025-01-30 09:56:14 dovecot_login authenticator failed for ([111.61.177.187]) [111.61.177.187]:63344: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 09:56:11 ait sshd[805556]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.246.255.183
description:
2025-01-30 09:57:12 dovecot_plain authenticator failed for ([185.246.255.183]) [185.246.255.183]:53023: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.37.171.161
description:
2025-01-30 09:57:23 dovecot_plain authenticator failed for ([59.37.171.161]) [59.37.171.161]:56466: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-01-30 09:56:52 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:42250: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.143
description:
2025-01-30 09:57:02 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.143]:8455: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
description:
Jan 30 09:57:08 ait sshd[806164]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Jan 30 09:57:08 ait sshd[806164]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 09:57:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.37.171.161
description:
Jan 30 09:57:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.37.171.161 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 122.155.223.159
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-57.122.155.223.159


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.143.166
description:
Jan 30 09:58:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.143.166
description:
2025-01-30 09:58:33 dovecot_plain authenticator failed for ([180.188.143.166]) [180.188.143.166]:56126: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 30 09:58:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-30 09:58:29 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:59072: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.48.185.134
description:
[2025-01-30 09:58:35 +0100] info [webmaild] 189.48.185.134 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.222.80.77
description:
Jan 30 09:59:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.222.80.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.119
description:
2025-01-30 09:59:14 dovecot_login authenticator failed for ([104.241.235.119]) [104.241.235.119]:40645: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 30 09:59:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.162.60
description:
[2025-01-30 09:59:26 +0100] info [webmaild] 170.254.162.60 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.92.51.175
description:
[2025-01-30 09:59:37 +0100] info [webmaild] 177.92.51.175 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-01-30 09:58:45 dovecot_plain authenticator failed for ([211.248.31.142]) [211.248.31.142]:55804: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 30 09:58:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-30 09:58:47 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:56654: 535 Incorrect authentication data (set_id=adams)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.121.199.203
description:
2025-01-30 09:58:51 dovecot_login authenticator failed for ool-4579c7cb.dyn.optonline.net [69.121.199.203]:45246: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 09:59:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.222.80.77
description:
2025-01-30 09:59:16 dovecot_login authenticator failed for ([91.222.80.77]) [91.222.80.77]:47410: 535 Incorrect authentication data (set_id=ads22a00122y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-30 09:59:28 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:59290: 535 Incorrect authentication data (set_id=ads22a00122y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.130
description:
Jan 30 09:59:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.130
description:
2025-01-30 09:59:49 dovecot_plain authenticator failed for ([123.212.0.130]) [123.212.0.130]:39978: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.47
description:
2025-01-30 09:59:59 dovecot_plain authenticator failed for ([178.178.222.47]) [178.178.222.47]:50386: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-30 10:00:26 dovecot_login authenticator failed for ([96.79.174.131]) [96.79.174.131]:38007: 535 Incorrect authentication data (set_id=adams@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 30 09:59:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-30 09:59:51 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:44174: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 30 10:00:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-30 10:00:04 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:55456: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.239.195.71
description:
[2025-01-30 10:00:31 +0100] info [webmaild] 45.239.195.71 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-30 10:01:17 dovecot_plain authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:52478: 535 Incorrect authentication data (set_id=ofei)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-01.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
description:
2025-01-30 10:00:50 dovecot_plain authenticator failed for ([116.114.84.246]) [116.114.84.246]:60266: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-30 10:00:52 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:37108: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.222.137.41
description:
2025-01-30 10:01:02 dovecot_plain authenticator failed for vps-09fc8581.vps.ovh.ca [51.222.137.41]:57036: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.108.234.111
description:
Jan 30 10:01:49 ait sshd[808265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.108.234.111 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.179
description:
47.128.43.179 - - [30/Jan/2025:10:02:28 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10839722 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/info.php?__im-TxjryfeB=5488985471466685394&id=724" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.179


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.150.88.37
description:
Jan 30 10:02:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.150.88.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 10:01:49 ait sshd[808265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 101.133.163.146
domain: lms.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-02.101.133.163.146


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 171.244.129.243
domain: lms.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-02.171.244.129.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.150.88.37
description:
2025-01-30 10:02:33 dovecot_login authenticator failed for ([127.0.0.1]) [121.150.88.37]:56904: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.57.33.221
description:
2025-01-30 10:02:43 dovecot_login authenticator failed for ([127.0.0.1]) [120.57.33.221]:42953: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.189.180.243
description:
Jan 30 10:03:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.189.180.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.163.234
description:
Jan 30 10:03:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.163.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.189.180.243
description:
2025-01-30 10:03:27 dovecot_login authenticator failed for ([90.189.180.243]) [90.189.180.243]:37465: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
description:
Jan 30 10:03:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.57.33.221
description:
Jan 30 10:02:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.57.33.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.163.234
description:
2025-01-30 10:03:28 dovecot_login authenticator failed for ([127.0.0.1]) [117.253.163.234]:50997: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
description:
2025-01-30 10:03:35 dovecot_login authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:52577: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.98.142
description:
2025-01-30 10:03:36 dovecot_login authenticator failed for ([127.0.0.1]) [91.75.98.142]:54603: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.218.157.227
description:
[2025-01-30 10:03:08 +0100] info [webmaild] 201.218.157.227 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.75.98.142
description:
Jan 30 10:03:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.75.98.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 30 10:03:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 30 10:04:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-30 10:04:17 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (plettes) [195.159.217.71]:44034: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.126.75.149
description:
[2025-01-30 10:04:19 +0100] info [webmaild] 45.126.75.149 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:UG20S1120028||WPU:UG20S1120028||RSV:6.65||T:APACHE||MV:10-04.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 10:03:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-30 10:03:58 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (paretaties) [85.69.178.104]:47826: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.180.149.232
description:
[2025-01-30 10:03:57 +0100] info [webmaild] 45.180.149.232 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.232.38.203
description:
[2025-01-30 10:05:13 +0100] info [webmaild] 88.232.38.203 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 30 10:05:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-30 10:05:28 dovecot_login authenticator failed for (nsg-static-250.173.71.182.airtel.in) [182.71.173.250]:46126: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
description:
Jan 30 10:04:58 ait sshd[809592]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Jan 30 10:04:58 ait sshd[809592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.57.214.111
description:
Jan 30 10:06:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.57.214.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.74
description:
Jan 30 10:06:03 ait sshd[810196]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.74 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.74
description:
Jan 30 10:06:03 ait sshd[810196]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.74


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.57.214.111
description:
2025-01-30 10:06:03 dovecot_plain authenticator failed for (pardes-hana-hotnet145-arris1-213-57-214-111.hotnet.net.il) [213.57.214.111]:61073: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.248.31.142
description:
2025-01-30 10:05:47 dovecot_login authenticator failed for ([211.248.31.142]) [211.248.31.142]:55650: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.72.153.14
description:
Jan 30 10:05:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.72.153.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.72.153.14
description:
2025-01-30 10:05:55 dovecot_plain authenticator failed for (160.72.153.14.lightower.net) [160.72.153.14]:50968: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-01-30 10:06:53 dovecot_login authenticator failed for ([123.214.65.245]) [123.214.65.245]:54390: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.56.218.198
description:
[2025-01-30 10:07:28 +0100] info [webmaild] 41.56.218.198 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Jan 30 10:06:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.108.147.210
description:
2025-01-30 10:07:02 dovecot_plain authenticator failed for (189-108-147-210.customer.tdatabrasil.net.br) [189.108.147.210]:39990: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.108.147.210
description:
Jan 30 10:07:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.108.147.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 30 10:07:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 10:07:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
description:
Jan 30 10:06:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
description:
2025-01-30 10:06:51 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:41727: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 10:06:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-30 10:07:09 dovecot_login authenticator failed for (20118168049.host.telemar.net.br) [200.202.250.46]:50865: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
description:
Jan 30 10:08:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.182.203.89
description:
Jan 30 10:08:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.182.203.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.127.217
description:
Jan 30 10:08:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.127.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.127.217
description:
2025-01-30 10:08:38 dovecot_plain authenticator failed for ([213.230.127.217]) [213.230.127.217]:53552: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 10:08:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.233.219.34
description:
2025-01-30 10:08:22 dovecot_plain authenticator failed for ([186.233.219.34]) [186.233.219.34]:44194: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.192.96.46
description:
[2025-01-30 10:08:17 +0100] info [webmaild] 186.192.96.46 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.40
description:
2025-01-30 10:08:22 dovecot_plain authenticator failed for (elver) [65.20.194.40]:46787: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.205
description:
2025-01-30 10:08:25 dovecot_plain authenticator failed for (contorbum) [65.20.155.205]:35391: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.240.128.87
description:
[2025-01-30 10:08:19 +0100] info [webmaild] 191.240.128.87 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.40
description:
Jan 30 10:08:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.233.219.34
description:
Jan 30 10:08:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.233.219.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.81
description:
Jan 30 10:07:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 10:08:08 dovecot_plain authenticator failed for (hiposces) [81.211.77.58]:58381: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.182.203.89
description:
2025-01-30 10:08:27 dovecot_plain authenticator failed for ([110.182.203.89]) [110.182.203.89]:40484: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.81
description:
2025-01-30 10:07:56 dovecot_plain authenticator failed for ([183.249.1.81]) [183.249.1.81]:58208: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 30 10:09:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 10:09:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.93.11.95
description:
[2025-01-30 10:09:10 +0100] info [webmaild] 178.93.11.95 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 10:09:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-30 10:09:34 dovecot_plain authenticator failed for ([112.172.189.90]) [112.172.189.90]:36782: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Jan 30 10:09:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-01-30 10:10:01 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:54323: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.210.129.51
description:
[2025-01-30 10:11:37 +0100] info [webmaild] 46.210.129.51 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.49.23
description:
47.128.49.23 - - [30/Jan/2025:10:10:44 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17447092 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/science/?filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.49.23


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 10:12:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.33.207.58
description:
2025-01-30 10:12:28 dovecot_plain authenticator failed for ([121.33.207.58]) [121.33.207.58]:45508: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.70.61.52
description:
[2025-01-30 10:12:16 +0100] info [webmaild] 45.70.61.52 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.33.207.58
description:
Jan 30 10:12:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.33.207.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.189.23.128
description:
[2025-01-30 10:12:29 +0100] info [webmaild] 177.189.23.128 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-30 10:12:38 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:42535: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
description:
2025-01-30 10:13:01 dovecot_plain authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:44329: 535 Incorrect authentication data (set_id=ads22b00248y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.183
description:
Jan 30 10:13:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.183
description:
2025-01-30 10:13:09 dovecot_plain authenticator failed for ([195.222.57.183]) [195.222.57.183]:57808: 535 Incorrect authentication data (set_id=ads22b00248y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.128.26.37
description:
[2025-01-30 10:13:11 +0100] info [webmaild] 177.128.26.37 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
description:
Jan 30 10:12:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 10:13:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 30 10:13:49 ait sshd[813273]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 10:13:49 ait sshd[813273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 30 10:13:54 ait sshd[813298]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 10:13:54 ait sshd[813298]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.26.197.236
description:
[2025-01-30 10:15:41 +0100] info [webmaild] 181.26.197.236 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.93.111
description:
[2025-01-30 10:16:20 +0100] info [webmaild] 213.230.93.111 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.201.114.144
description:
[2025-01-30 10:16:32 +0100] info [webmaild] 88.201.114.144 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.135.102.194
description:
Jan 30 10:17:38 ait sshd[814816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.135.102.194


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.138.168.229
description:
[2025-01-30 10:17:17 +0100] info [webmaild] 177.138.168.229 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.135.102.194
description:
Jan 30 10:17:41 ait sshd[814816]: Disconnected from invalid user ubuntu 148.135.102.194 port 34426 [preauth]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
description:
Jan 30 10:18:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-01-30 10:18:02 dovecot_plain authenticator failed for ([5.189.118.24]) [5.189.118.24]:34030: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.45.235.146
description:
Jan 30 10:18:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.45.235.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.45.235.146
description:
2025-01-30 10:18:27 dovecot_plain authenticator failed for ([27.45.235.146]) [27.45.235.146]:44594: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
description:
2025-01-30 10:19:32 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:46224: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.158.157
description:
Jan 30 10:19:25 ait sshd[815575]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.158.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
description:
Jan 30 10:19:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.126.232.234
description:
[2025-01-30 10:19:37 +0100] info [webmaild] 177.126.232.234 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.196.141
description:
Jan 30 10:19:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.196.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.196.141
description:
2025-01-30 10:19:19 dovecot_plain authenticator failed for ([120.238.196.141]) [120.238.196.141]:58214: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.158.157
description:
Jan 30 10:19:25 ait sshd[815575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.158.157


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.55.200.53
description:
[2025-01-30 10:20:28 +0100] info [webmaild] 191.55.200.53 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.245.27.242
description:
[2025-01-30 10:20:23 +0100] info [webmaild] 170.245.27.242 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.91.186.55
description:
Jan 30 10:20:54 ait sshd[816262]: pam_imunify(sshd:auth): [IM360_RBL] The IP 117.91.186.55 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 117.91.186.55
description:
Jan 30 10:20:54 ait sshd[816262]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=117.91.186.55


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.249.196.103
description:
[2025-01-30 10:21:19 +0100] info [webmaild] 186.249.196.103 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
description:
Jan 30 10:21:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
description:
2025-01-30 10:21:36 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:59992: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.135.102.194
description:
Jan 30 10:22:04 ait sshd[816696]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.135.102.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Jan 30 10:21:42 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 30 10:21:55 ait sshd[816648]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.158.157
description:
Jan 30 10:22:21 ait sshd[816803]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.158.157


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.51
description:
47.128.98.51 - - [30/Jan/2025:10:22:13 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12206943 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/9/?duration=extraLong&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 30 10:22:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 30 10:21:55 ait sshd[816648]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
description:
2025-01-30 10:22:12 dovecot_plain authenticator failed for ([124.114.149.106]) [124.114.149.106]:41875: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-30 10:22:28 dovecot_plain authenticator failed for ([200.149.54.14]) [200.149.54.14]:59779: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.126.104
description:
Jan 30 10:22:37 ait sshd[816830]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.126.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-01-30 10:22:01 dovecot_plain authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:35105: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 30 10:21:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.158.157
description:
Jan 30 10:22:21 ait sshd[816803]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.158.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Jan 30 10:22:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.126.104
description:
Jan 30 10:22:37 ait sshd[816830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.126.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-30 10:21:44 dovecot_plain authenticator failed for ([65.20.205.197]) [65.20.205.197]:49270: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.149.106
description:
Jan 30 10:22:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.149.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-01-30 10:22:39 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:47806: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.103.126.104
description:
Jan 30 10:22:41 ait sshd[816830]: Disconnected from invalid user admin 14.103.126.104 port 33052 [preauth]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.218.89.34
description:
[2025-01-30 10:23:40 +0100] info [webmaild] 91.218.89.34 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Jan 30 10:23:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 148.135.102.194
description:
Jan 30 10:23:16 ait sshd[817286]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=148.135.102.194


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 148.135.102.194
description:
Jan 30 10:23:18 ait sshd[817286]: Failed password for invalid user deploy from 148.135.102.194 port 59946 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-01-30 10:23:39 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:45724: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.106.134.64
description:
[2025-01-30 10:24:21 +0100] info [webmaild] 85.106.134.64 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.67.178.224
description:
[2025-01-30 10:24:32 +0100] info [webmaild] 102.67.178.224 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.158.157
description:
Jan 30 10:23:44 ait sshd[817428]: pam_imunify(sshd:auth): [IM360_RBL] The IP 64.227.158.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.158.157
description:
Jan 30 10:23:44 ait sshd[817428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.158.157


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.171.20.211
description:
Jan 30 10:23:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.171.20.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.171.20.211
description:
2025-01-30 10:23:53 dovecot_login authenticator failed for (106.51.79.73.actcorp.in) [122.171.20.211]:13143: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 30 10:25:17 ait sshd[818226]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.91.84.252
description:
[2025-01-30 10:25:17 +0100] info [webmaild] 181.91.84.252 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 10:25:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 30 10:25:17 ait sshd[818226]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.54.70.126
description:
2025-01-30 10:25:47 dovecot_login authenticator failed for ([127.0.0.1]) [95.54.70.126]:33902: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 10:26:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.126.104
description:
Jan 30 10:26:24 ait sshd[818731]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.126.104 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.126.104
description:
Jan 30 10:26:24 ait sshd[818731]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.126.104


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.126.65.135
description:
2025-01-30 10:25:59 dovecot_login authenticator failed for ([216.126.65.135]) [216.126.65.135]:42110: 535 Incorrect authentication data (set_id=submit@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 30 10:25:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-30 10:25:56 dovecot_plain authenticator failed for (closm) [102.53.15.17]:58365: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.216.135.13
description:
Jan 30 10:25:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.216.135.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.216.135.13
description:
2025-01-30 10:25:58 dovecot_login authenticator failed for ([127.0.0.1]) [103.216.135.13]:56276: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
description:
2025-01-30 10:26:09 dovecot_login authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:34544: 535 Incorrect authentication data (set_id=submit)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.54.70.126
description:
Jan 30 10:25:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.54.70.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.224.55.22
description:
Jan 30 10:26:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.224.55.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 10:27:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.224.55.22
description:
2025-01-30 10:26:59 dovecot_plain authenticator failed for ([58.224.55.22]) [58.224.55.22]:56434: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Jan 30 10:26:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-01-30 10:26:48 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:60570: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.73.53.131
description:
[2025-01-30 10:27:43 +0100] info [webmaild] 177.73.53.131 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 10:27:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.55.14.178
description:
Jan 30 10:27:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.55.14.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.55.14.178
description:
2025-01-30 10:27:53 dovecot_login authenticator failed for ([127.0.0.1]) [95.55.14.178]:43944: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.122.79
description:
2025-01-30 10:27:47 dovecot_login authenticator failed for ([127.0.0.1]) [85.215.122.79]:50609: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.62.176.252
description:
[2025-01-30 10:28:21 +0100] info [webmaild] 206.62.176.252 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.214.36.83
description:
[2025-01-30 10:28:33 +0100] info [webmaild] 102.214.36.83 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.122.79
description:
Jan 30 10:27:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.122.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 10:27:47 dovecot_plain authenticator failed for (hometrawk) [207.188.157.230]:16936: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.126.104
description:
Jan 30 10:28:01 ait sshd[819550]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.126.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 178.159.43.75
domain: gvu.titopen.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:10-27.178.159.43.75||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.126.104
description:
Jan 30 10:28:01 ait sshd[819550]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.126.104


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 10:29:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.230.172.131
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-28.157.230.172.131


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 10:29:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 30 10:29:22 ait sshd[820014]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 10:29:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.42.140.225
description:
[2025-01-30 10:29:17 +0100] info [webmaild] 186.42.140.225 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 30 10:29:22 ait sshd[820014]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-29.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.72.74.162
description:
Jan 30 10:29:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.72.74.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
description:
2025-01-30 10:29:48 dovecot_plain authenticator failed for (cottride) [64.72.74.162]:56595: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Jan 30 10:30:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.3.154.183
description:
Jan 30 10:30:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.3.154.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-01-30 10:30:58 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:59236: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 30 10:31:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.3.154.183
description:
2025-01-30 10:30:46 dovecot_plain authenticator failed for ([212.3.154.183]) [212.3.154.183]:55643: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.90.129.81
description:
[2025-01-30 10:32:39 +0100] info [whostmgrd] 164.90.129.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.24
description:
2025-01-30 10:32:13 dovecot_login authenticator failed for ([121.202.152.24]) [121.202.152.24]:3816: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 31131
name: Anti-bot protection. User failed to pass
abuser: 47.128.62.157
description:
47.128.62.157 - - [30/Jan/2025:10:32:20 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11836393 HTTP/2.0" 404 150 lms.aitsmartschool.com "-" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.157


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.127.218.247
description:
[2025-01-30 10:32:25 +0100] info [webmaild] 185.127.218.247 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.24
description:
Jan 30 10:32:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 30 10:32:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.210.144
description:
[2025-01-30 10:31:40 +0100] info [webmaild] 191.37.210.144 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.150.178
description:
Jan 30 10:32:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.150.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.150.178
description:
2025-01-30 10:32:02 dovecot_login authenticator failed for ([178.46.150.178]) [178.46.150.178]:44674: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.209.88.227
description:
[2025-01-30 10:32:35 +0100] info [webmaild] 181.209.88.227 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.223.58
description:
2025-01-30 10:33:29 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.223.58]:44517: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.226.118
description:
Jan 30 10:33:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.226.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.13.4.119
description:
Jan 30 10:33:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.13.4.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
description:
2025-01-30 10:33:36 dovecot_login authenticator failed for ([101.13.4.119]) [101.13.4.119]:47114: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-30 10:32:46 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com (enfruster) [131.106.85.205]:44714: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.142.53.59
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:edonkor@ait.edu.gh||WPU:edonkor@ait.edu.gh||RSV:6.65||T:APACHE||MV:10-33.83.142.53.59


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-30 10:33:15 dovecot_login authenticator failed for ([211.199.5.231]) [211.199.5.231]:59852: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.223.58
description:
Jan 30 10:33:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.226.118
description:
2025-01-30 10:33:34 dovecot_plain authenticator failed for ([61.185.226.118]) [61.185.226.118]:49099: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 30 10:32:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.93.87.71
description:
2025-01-30 10:33:01 dovecot_plain authenticator failed for ([119.93.87.71]) [119.93.87.71]:50531: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.163.142.17
description:
[2025-01-30 10:33:14 +0100] info [webmaild] 164.163.142.17 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.206.193.131
description:
Jan 30 10:34:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.206.193.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 30 10:34:02 ait sshd[822105]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 30 10:34:02 ait sshd[822105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.124.221.2
description:
Jan 30 10:34:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.124.221.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.124.221.2
description:
2025-01-30 10:34:19 dovecot_plain authenticator failed for ip-213-124-221-2.ip.prioritytelecom.net [213.124.221.2]:47774: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.206.193.131
description:
2025-01-30 10:34:26 dovecot_plain authenticator failed for host-37-206-193-131.business.telecomitalia.it [37.206.193.131]:51124: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.31.6
description:
47.128.31.6 - - [30/Jan/2025:10:34:24 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4710536 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-category/math/?filtering=1&price_type=free&tutor-course-filter-category=249" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.31.6


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.95.14.102
description:
Jan 30 10:34:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.95.14.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.183.76.63
description:
2025-01-30 10:35:29 dovecot_plain authenticator failed for ([121.183.76.63]) [121.183.76.63]:34520: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Jan 30 10:35:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.183.76.63
description:
Jan 30 10:35:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.183.76.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.41.249.3
description:
Jan 30 10:34:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.41.249.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Jan 30 10:35:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.131.106.226
description:
[2025-01-30 10:36:22 +0100] info [webmaild] 37.131.106.226 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
description:
2025-01-30 10:35:40 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:52652: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.206.1.10
description:
[2025-01-30 10:36:33 +0100] info [webmaild] 31.206.1.10 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.186.108.88
description:
[2025-01-30 10:35:44 +0100] info [webmaild] 138.186.108.88 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.141.111.83
description:
[2025-01-30 10:37:10 +0100] info [webmaild] 190.141.111.83 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.18.106
description:
47.128.18.106 - - [30/Jan/2025:10:37:05 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14503794 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/index.php?Itemid=76&id=60&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.18.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 10:38:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 30 10:39:39 ait sshd[824575]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 10:38:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 30 10:38:53 ait sshd[824241]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 10:38:53 ait sshd[824241]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 30 10:39:39 ait sshd[824575]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.127.238
description:
[2025-01-30 10:39:48 +0100] info [webmaild] 179.125.127.238 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.197
description:
Jan 30 10:40:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.197 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.13.200.154
description:
[2025-01-30 10:40:38 +0100] info [webmaild] 41.13.200.154 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 30 10:39:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-30 10:39:47 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (unambolut) [81.16.170.117]:53284: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.125
description:
Jan 30 10:40:37 ait sshd[825151]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.125  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.151.155.180
description:
[2025-01-30 10:40:37 +0100] info [webmaild] 190.151.155.180 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Jan 30 10:41:32 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.112.125
description:
Jan 30 10:40:44 ait sshd[825192]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.112.125  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 8.209.251.101
description:
Jan 30 10:40:53 ait sshd[825254]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.209.251.101


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-01-30 10:41:34 dovecot_login authenticator failed for 186-247-192-94.user.veloxzone.com.br [186.247.192.94]:60108: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.191.46.247
description:
[2025-01-30 10:41:30 +0100] info [webmaild] 181.191.46.247 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 30 10:40:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
description:
Jan 30 10:42:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
description:
2025-01-30 10:42:06 dovecot_login authenticator failed for ([1.241.64.92]) [1.241.64.92]:38158: 535 Incorrect authentication data (set_id=grahamyvirg@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.148.173.150
description:
2025-01-30 10:42:16 dovecot_login authenticator failed for ([189.108.24.17]) [200.148.173.150]:58383: 535 Incorrect authentication data (set_id=grahamyvirg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.85.107.135
description:
Jan 30 10:41:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.85.107.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.85.107.135
description:
2025-01-30 10:41:53 dovecot_login authenticator failed for ([222.85.107.135]) [222.85.107.135]:48838: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.202.148.110
description:
Jan 30 10:42:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.202.148.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.202.148.110
description:
2025-01-30 10:42:59 dovecot_plain authenticator failed for ([94.202.148.110]) [94.202.148.110]:46868: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 30 10:43:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.3.159.176
description:
Jan 30 10:43:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.3.159.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.232.206
description:
2025-01-30 10:43:15 dovecot_plain authenticator failed for ([177.6.232.206]) [177.6.232.206]:48402: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-30 10:43:16 dovecot_plain authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:55541: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.92.192.154
description:
Jan 30 10:42:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.92.192.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.92.192.154
description:
2025-01-30 10:42:46 dovecot_plain authenticator failed for (200-153-56-145.sgsnet.com.br) [187.92.192.154]:52904: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.207.252.124
description:
Jan 30 10:43:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.207.252.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.135.66.173
description:
Jan 30 10:43:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.135.66.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.135.66.173
description:
2025-01-30 10:43:10 dovecot_plain authenticator failed for ([182.135.66.173]) [182.135.66.173]:42706: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
description:
Jan 30 10:43:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.232.206
description:
Jan 30 10:43:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.232.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.3.159.176
description:
2025-01-30 10:43:26 dovecot_plain authenticator failed for (192-3-159-176-host.colocrossing.com) [192.3.159.176]:38452: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.207.252.124
description:
2025-01-30 10:43:04 dovecot_plain authenticator failed for (pool-31-207-252-124.is74.ru) [31.207.252.124]:49438: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 30 10:43:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-30 10:43:17 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:38631: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 10:44:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
description:
2025-01-30 10:43:42 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:40878: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.145.128
description:
Jan 30 10:43:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.145.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.172.84.203
description:
[2025-01-30 10:43:52 +0100] info [webmaild] 46.172.84.203 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 30 10:43:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.168
description:
2025-01-30 10:43:56 dovecot_plain authenticator failed for ([61.80.161.168]) [61.80.161.168]:36507: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.66.209
description:
2025-01-30 10:43:42 dovecot_plain authenticator failed for 209.66.246.220.static.netvigator.com [220.246.66.209]:58755: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.236.145.128
description:
2025-01-30 10:43:53 dovecot_plain authenticator failed for ([104.236.145.128]) [104.236.145.128]:55371: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 30 10:44:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-30 10:44:01 dovecot_plain authenticator failed for (gling) [149.0.16.4]:39730: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-43.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-30 10:43:57 dovecot_plain authenticator failed for (esthoped) [164.92.243.206]:49548: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-30 10:44:03 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (phots) [195.159.217.71]:49566: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.66.209
description:
Jan 30 10:43:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.66.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.237.3
description:
Jan 30 10:45:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.237.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.237.3
description:
2025-01-30 10:45:19 dovecot_plain authenticator failed for (broadband-37.204-237-3.ip.moscow.rt.ru) [37.204.237.3]:35068: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.77.118
description:
Jan 30 10:45:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.77.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.181.59.107
description:
[2025-01-30 10:44:42 +0100] info [webmaild] 191.181.59.107 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 30 10:45:05 ait sshd[826967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.38.100.151
description:
Jan 30 10:45:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.38.100.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.38.100.151
description:
2025-01-30 10:45:26 dovecot_plain authenticator failed for ([209.38.100.151]) [209.38.100.151]:44414: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.77.118
description:
2025-01-30 10:45:30 dovecot_plain authenticator failed for ([122.227.77.118]) [122.227.77.118]:46143: 535 Incorrect authentication data (set_id=pg23j2050041@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.124.71.192
description:
[2025-01-30 10:45:37 +0100] info [webmaild] 27.124.71.192 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 144.48.85.84
description:
[2025-01-30 10:44:43 +0100] info [webmaild] 144.48.85.84 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 30 10:45:05 ait sshd[826967]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.39
description:
Jan 30 10:45:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.39
description:
2025-01-30 10:45:50 dovecot_plain authenticator failed for ([61.185.68.39]) [61.185.68.39]:58693: 535 Incorrect authentication data (set_id=pg23j2050041)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 30 10:46:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.162.46.212
description:
Jan 30 10:46:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.162.46.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-30 10:46:07 dovecot_plain authenticator failed for (ingly) [102.53.15.56]:50073: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.162.46.212
description:
2025-01-30 10:46:37 dovecot_login authenticator failed for ([127.0.0.1]) [14.162.46.212]:41381: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.134
description:
Jan 30 10:45:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.134
description:
2025-01-30 10:45:52 dovecot_login authenticator failed for ([211.109.93.134]) [211.109.93.134]:39094: 535 Incorrect authentication data (set_id=grahamyvirg@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-01-30 10:46:01 dovecot_login authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:48676: 535 Incorrect authentication data (set_id=grahamyvirg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 30 10:46:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.143
description:
2025-01-30 10:47:18 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.143]:11470: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.157.206.202
description:
Jan 30 10:46:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.157.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 30 10:46:45 ait sshd[827671]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.206.202
description:
2025-01-30 10:46:47 dovecot_login authenticator failed for ([127.0.0.1]) [120.157.206.202]:42678: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.118.126.35
description:
Jan 30 10:47:17 ait sshd[827930]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.118.126.35 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.118.126.35
description:
Jan 30 10:47:17 ait sshd[827930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.118.126.35  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.176.69.144
description:
[2025-01-30 10:47:53 +0100] info [webmaild] 45.176.69.144 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.29.196.162
description:
Jan 30 10:47:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.29.196.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.29.196.162
description:
2025-01-30 10:47:57 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [218.29.196.162]:54224: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.135.152.21
description:
[2025-01-30 10:48:40 +0100] info [webmaild] 179.135.152.21 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.89.146
description:
2025-01-30 10:49:40 dovecot_plain authenticator failed for ([58.18.89.146]) [58.18.89.146]:51109: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 151.236.166.140
description:
[2025-01-30 10:48:43 +0100] info [webmaild] 151.236.166.140 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.208.108.52
description:
Jan 30 10:49:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.208.108.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.208.108.52
description:
2025-01-30 10:49:21 dovecot_plain authenticator failed for ([60.208.108.52]) [60.208.108.52]:43028: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Jan 30 10:49:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.36.16.66
description:
[2025-01-30 10:49:35 +0100] info [webmaild] 181.36.16.66 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-01-30 10:49:36 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:35100: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.19.47.79
description:
Jan 30 10:49:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.19.47.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.19.47.79
description:
2025-01-30 10:49:17 dovecot_plain authenticator failed for ([187.19.47.79]) [187.19.47.79]:62230: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.120.40
description:
Jan 30 10:50:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.120.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
description:
2025-01-30 10:50:35 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:34738: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Ug20s1120028||WPU:Ug20s1120028||RSV:6.65||T:APACHE||MV:10-50.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-01-30 10:50:45 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:34839: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.45.204.21
description:
2025-01-30 10:51:18 dovecot_login authenticator failed for ([127.0.0.1]) [46.45.204.21]:55118: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Jan 30 10:50:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.141.47.56
description:
Jan 30 10:51:26 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.141.47.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.206.140
description:
Jan 30 10:50:50 ait sshd[829619]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.206.140


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.45.204.21
description:
Jan 30 10:51:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.45.204.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.47.56
description:
2025-01-30 10:51:28 dovecot_login authenticator failed for p286057-obmd01.tokyo.ocn.ne.jp ([127.0.0.1]) [153.141.47.56]:47921: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.169.144.176
description:
2025-01-30 10:52:12 dovecot_login authenticator failed for 136.169.144.176.dynamic.ufanet.ru ([127.0.0.1]) [136.169.144.176]:55504: 535 Incorrect authentication data (set_id=eng20b00167y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.255.169.73
description:
[2025-01-30 10:52:39 +0100] info [webmaild] 179.255.169.73 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.26.72.85
description:
[2025-01-30 10:51:50 +0100] info [webmaild] 197.26.72.85 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.1.234.86
description:
2025-01-30 10:52:05 dovecot_login authenticator failed for ([127.0.0.1]) [117.1.234.86]:60572: 535 Incorrect authentication data (set_id=eng20b00167y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.1.234.86
description:
Jan 30 10:52:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.1.234.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.169.144.176
description:
Jan 30 10:52:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.169.144.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.120.188.194
description:
[2025-01-30 10:52:40 +0100] info [webmaild] 190.120.188.194 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-30 10:52:45 dovecot_plain authenticator failed for ([217.32.209.50]) [217.32.209.51]:48927: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Ug20s1120028||WPU:Ug20s1120028||RSV:6.65||T:APACHE||MV:10-52.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.143
description:
Jan 30 10:52:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.143
description:
2025-01-30 10:52:56 dovecot_plain authenticator failed for ([122.187.227.143]) [122.187.227.143]:42744: 535 Incorrect authentication data (set_id=bscs18bit0012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Jan 30 10:52:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.163.216
description:
Jan 30 10:53:34 ait sshd[830626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.163.216


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 88.201.112.112
description:
[2025-01-30 10:53:34 +0100] info [webmaild] 88.201.112.112 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.197
description:
2025-01-30 10:54:25 dovecot_plain authenticator failed for (nlos-200-197.zamnet.zm) [196.46.200.197]:53622: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
description:
2025-01-30 10:54:33 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:63854: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.161.52.149
description:
2025-01-30 10:54:14 dovecot_plain authenticator failed for ([220.161.52.149]) [220.161.52.149]:45666: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.197
description:
Jan 30 10:54:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.197 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 10:54:23 ait sshd[831034]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 30 10:54:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-30 10:54:22 dovecot_plain authenticator failed for ([218.98.26.226]) [58.216.101.162]:44108: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
description:
Jan 30 10:54:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.18.11.94
description:
Jan 30 10:55:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.18.11.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.18.11.94
description:
2025-01-30 10:55:04 dovecot_login authenticator failed for ([127.0.0.1]) [37.18.11.94]:48508: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-30 10:55:46 dovecot_plain authenticator failed for ([121.179.93.147]) [121.179.93.147]:43366: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 24.152.103.218
description:
[2025-01-30 10:55:51 +0100] info [webmaild] 24.152.103.218 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.193.126
description:
2025-01-30 10:56:25 dovecot_login authenticator failed for ([127.0.0.1]) [190.121.193.126]:55160: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.212.219
description:
Jan 30 10:55:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.212.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 10:55:55 ait sshd[831733]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-30 10:55:55 dovecot_plain authenticator failed for (coridged) [164.92.243.206]:60450: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.34.147
description:
2025-01-30 10:56:17 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.34.147]:50791: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 30 10:55:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 30 10:55:53 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.212.219
description:
2025-01-30 10:55:55 dovecot_plain authenticator failed for net-93-64-212-219.cust.vodafonedsl.it [93.64.212.219]:50795: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.175.8.140
description:
Jan 30 10:56:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.175.8.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.193.126
description:
Jan 30 10:56:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.193.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.63.107.240
description:
[2025-01-30 10:56:38 +0100] info [webmaild] 200.63.107.240 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.106.67.50
description:
2025-01-30 10:55:51 dovecot_plain authenticator failed for 216.106.67.50.reverse.socket.net [216.106.67.50]:54920: 535 Incorrect authentication data (set_id=baah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.175.8.140
description:
2025-01-30 10:56:02 dovecot_plain authenticator failed for ([121.175.8.140]) [121.175.8.140]:58544: 535 Incorrect authentication data (set_id=baah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.34.147
description:
Jan 30 10:56:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.34.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 202.134.13.139
description:
[2025-01-30 10:57:32 +0100] info [webmaild] 202.134.13.139 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.93.193.217
description:
[2025-01-30 10:56:41 +0100] info [webmaild] 177.93.193.217 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.115.104.38
description:
Jan 30 10:56:59 ait sshd[832311]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.115.104.38  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:10-57.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 30 10:58:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-30 10:58:33 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:47398: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.163.216
description:
Jan 30 10:58:59 ait sshd[833247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.163.216


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.85.183.88
description:
2025-01-30 10:59:19 dovecot_plain authenticator failed for a88.sub183.net78.udm.net (yastory) [78.85.183.88]:65057: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.223.192.254
description:
Jan 30 10:58:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.223.192.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.223.192.254
description:
2025-01-30 10:58:43 dovecot_plain authenticator failed for ([200.223.192.254]) [200.223.192.254]:37326: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.29.232.5
description:
[2025-01-30 10:59:49 +0100] info [webmaild] 186.29.232.5 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.23.228
description:
47.128.23.228 - - [30/Jan/2025:10:59:53 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=26818086 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=337&id=279&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.23.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.150.178
description:
Jan 30 11:00:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.150.178 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.185.151.114
description:
[2025-01-30 11:00:38 +0100] info [webmaild] 197.185.151.114 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.29.203.126
description:
Jan 30 11:00:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.29.203.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.203.126
description:
2025-01-30 11:00:16 dovecot_plain authenticator failed for 126-203-29-85.dyn.estpak.ee [85.29.203.126]:52455: 535 Incorrect authentication data (set_id=wilfri17@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.150.178
description:
2025-01-30 11:00:36 dovecot_plain authenticator failed for ([178.46.150.178]) [178.46.150.178]:37296: 535 Incorrect authentication data (set_id=wilfri17)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.12.14
description:
2025-01-30 11:01:24 dovecot_plain authenticator failed for (14.12.168.188.retail.ttk.ru) [188.168.12.14]:58984: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.240.121.31
description:
2025-01-30 11:01:27 dovecot_plain authenticator failed for cm-72-240-121-31.buckeyecom.net [72.240.121.31]:3301: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 188.3.200.185
description:
[2025-01-30 11:01:13 +0100] info [webmaild] 188.3.200.185 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.12.14
description:
Jan 30 11:01:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.12.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.240.121.31
description:
Jan 30 11:01:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.240.121.31 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
description:
Jan 30 11:01:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.180.240.96
description:
Jan 30 11:01:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.180.240.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.180.240.96
description:
2025-01-30 11:01:36 dovecot_plain authenticator failed for ([103.180.240.96]) [103.180.240.96]:44682: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 30 11:01:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-30 11:02:30 dovecot_login authenticator failed for ([196.191.212.235]) [213.55.85.202]:2511: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.58.121
description:
Jan 30 11:01:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.58.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-30 11:02:21 dovecot_login authenticator failed for ([116.113.253.178]) [116.113.253.178]:51760: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 120.48.163.216
description:
Jan 30 11:02:30 ait sshd[834812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=120.48.163.216


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 129.213.196.213
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-02.129.213.196.213


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.58.121
description:
2025-01-30 11:01:42 dovecot_plain authenticator failed for ([185.167.58.121]) [185.167.58.121]:51588: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.206.140
description:
Jan 30 11:02:20 ait sshd[834645]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.206.140


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 120.48.163.216
description:
Jan 30 11:02:33 ait sshd[834812]: Failed password for invalid user ilya from 120.48.163.216 port 36536 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.84.132.142
description:
Jan 30 11:01:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.84.132.142 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.227.22
description:
[2025-01-30 11:02:09 +0100] info [webmaild] 177.8.227.22 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 30 11:02:56 ait sshd[834998]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 30 11:03:17 ait sshd[835100]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.202.83.139
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads20a00163y@ait.edu.gh||WPU:ads20a00163y@ait.edu.gh||RSV:6.65||T:APACHE||MV:11-03.193.202.83.139


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.167.194.204
description:
Jan 30 11:04:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.167.194.204 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 11:03:42 ait sshd[835469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.242.172.103
description:
Jan 30 11:04:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.242.172.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.242.172.103
description:
2025-01-30 11:04:12 dovecot_login authenticator failed for ([127.0.0.1]) [117.242.172.103]:51726: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.232.203.36
description:
[2025-01-30 11:03:43 +0100] info [webmaild] 181.232.203.36 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.250.209.132
description:
[2025-01-30 11:04:36 +0100] info [webmaild] 196.250.209.132 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.167.194.204
description:
2025-01-30 11:04:03 dovecot_login authenticator failed for ([127.0.0.1]) [113.167.194.204]:47957: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.135.172.213
description:
[2025-01-30 11:05:23 +0100] info [webmaild] 102.135.172.213 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.204
description:
Jan 30 11:05:29 ait sshd[836111]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.204  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.170.237
description:
2025-01-30 11:06:17 dovecot_plain authenticator failed for ([103.250.160.76]) [117.198.170.237]:42466: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.25.44
description:
[2025-01-30 11:06:21 +0100] info [webmaild] 170.254.25.44 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 11:05:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.149.231.251
description:
Jan 30 11:06:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.149.231.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.149.231.251
description:
2025-01-30 11:06:48 dovecot_plain authenticator failed for ([47.149.231.251]) [47.149.231.251]:41536: 535 Incorrect authentication data (set_id=eng19b00159y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.79
description:
2025-01-30 11:07:15 dovecot_plain authenticator failed for 079.42.246.220.static.netvigator.com [220.246.42.79]:64205: 535 Incorrect authentication data (set_id=ads21b00153y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.50.67.114
description:
Jan 30 11:07:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.50.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.50.67.114
description:
2025-01-30 11:07:26 dovecot_plain authenticator failed for (187-93-74-213.customer.tdatabrasil.net.br) [187.50.67.114]:58418: 535 Incorrect authentication data (set_id=ads21b00153y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-30 11:06:45 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:54711: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.162.190.243
description:
Jan 30 11:07:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.162.190.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.190.243
description:
2025-01-30 11:07:02 dovecot_plain authenticator failed for ([221.162.190.243]) [221.162.190.243]:44882: 535 Incorrect authentication data (set_id=eng19b00159y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.42.79
description:
Jan 30 11:07:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.42.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 30 11:08:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.24.194.207
description:
Jan 30 11:08:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.24.194.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.194.207
description:
2025-01-30 11:08:22 dovecot_plain authenticator failed for ([59.24.194.207]) [59.24.194.207]:33174: 535 Incorrect authentication data (set_id=abs18a00023y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.92.82
description:
[2025-01-30 11:08:05 +0100] info [webmaild] 213.230.92.82 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-30 11:08:11 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:57108: 535 Incorrect authentication data (set_id=abs18a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Jan 30 11:09:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 30 11:08:49 ait sshd[837535]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.110.225.4
description:
[2025-01-30 11:08:53 +0100] info [webmaild] 189.110.225.4 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-01-30 11:09:41 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:11234: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.210.188.130
description:
Jan 30 11:09:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.210.188.130 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.91.87.181
description:
[2025-01-30 11:09:51 +0100] info [webmaild] 181.91.87.181 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.210.188.130
description:
2025-01-30 11:09:51 dovecot_plain authenticator failed for ([58.210.188.130]) [58.210.188.130]:52142: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.231
description:
Jan 30 11:11:26 ait sshd[838487]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.231  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.183.46.39
description:
[2025-01-30 11:10:49 +0100] info [webmaild] 187.183.46.39 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.229
description:
Jan 30 11:11:14 ait sshd[838461]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.229  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.219
description:
Jan 30 11:10:56 ait sshd[838256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.219  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-11.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 30 11:12:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-30 11:12:16 dovecot_login authenticator failed for ([218.147.6.84]) [218.147.6.84]:52896: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 30 11:11:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 92.124.162.134
description:
[2025-01-30 11:12:00 +0100] info [webmaild] 92.124.162.134 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-30 11:12:00 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:50168: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
description:
Jan 30 11:13:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
description:
2025-01-30 11:13:29 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:43880: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.227.77
description:
Jan 30 11:13:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.227.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
description:
Jan 30 11:13:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.227.77
description:
2025-01-30 11:13:37 dovecot_plain authenticator failed for (grupokrause.static.gvt.net.br) [179.185.227.77]:45458: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
description:
2025-01-30 11:13:39 dovecot_plain authenticator failed for ([36.110.161.134]) [36.110.161.134]:33321: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.159.116.132
description:
[2025-01-30 11:12:51 +0100] info [webmaild] 102.159.116.132 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.206.140
description:
Jan 30 11:13:43 ait sshd[839644]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.206.140


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-30 11:14:06 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:55258: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.93.198
description:
Jan 30 11:14:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.93.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 11:14:22 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:37790: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.116.158.238
description:
Jan 30 11:14:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.116.158.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.116.158.238
description:
2025-01-30 11:14:32 dovecot_login authenticator failed for ([127.0.0.1]) [123.116.158.238]:48550: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.53.127
description:
[2025-01-30 11:14:02 +0100] info [webmaild] 191.242.53.127 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 30 11:14:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 107.167.90.149
description:
[2025-01-30 11:13:59 +0100] info [webmaild] 107.167.90.149 - vondee@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.227
description:
Jan 30 11:14:38 ait sshd[840026]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.227  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.99.210
description:
2025-01-30 11:13:49 dovecot_plain authenticator failed for ([222.160.99.210]) [222.160.99.210]:36436: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.161.166.113
description:
2025-01-30 11:13:57 dovecot_plain authenticator failed for static-css-csu-166113.business.bouyguestelecom.com [176.161.166.113]:36256: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.206.153
description:
Jan 30 11:16:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.206.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.206.153
description:
2025-01-30 11:16:09 dovecot_plain authenticator failed for pool-108-18-206-153.washdc.fios.verizon.net (prialize) [108.18.206.153]:47801: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.68.65.232
description:
[2025-01-30 11:16:02 +0100] info [webmaild] 189.68.65.232 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.117
description:
47.128.118.117 - - [30/Jan/2025:11:16:42 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20699152 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/medicine/?filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.117


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-30 11:17:39 dovecot_plain authenticator failed for (spanseuro) [109.108.95.66]:34715: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 169.224.9.42
description:
[2025-01-30 11:16:52 +0100] info [webmaild] 169.224.9.42 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 11:17:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.224.198
description:
Jan 30 11:18:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.224.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.224.198
description:
2025-01-30 11:18:26 dovecot_plain authenticator failed for (vardorle) [65.20.224.198]:32781: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.186.246.117
description:
[2025-01-30 11:18:06 +0100] info [webmaild] 45.186.246.117 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-30 11:18:46 dovecot_plain authenticator failed for (hylascia) [102.53.15.18]:36198: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 107.167.90.149
description:
[2025-01-30 11:19:40 +0100] info [webmaild] 107.167.90.149 - vondee@ait.edu.gh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 30 11:18:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.97.114.149
description:
Jan 30 11:19:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.97.114.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.97.114.149
description:
2025-01-30 11:19:33 dovecot_plain authenticator failed for c-73-97-114-149.hsd1.wa.comcast.net [73.97.114.149]:33221: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.112.9.182
description:
[2025-01-30 11:19:03 +0100] info [webmaild] 186.112.9.182 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.149.106
description:
Jan 30 11:19:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.149.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.231.141
description:
2025-01-30 11:20:10 dovecot_plain authenticator failed for ip85-215-231-141.pbiaas.com [85.215.231.141]:49193: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.231.141
description:
Jan 30 11:20:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.231.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
description:
2025-01-30 11:19:49 dovecot_plain authenticator failed for ([124.114.149.106]) [124.114.149.106]:41548: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.151.55.184
description:
[2025-01-30 11:20:06 +0100] info [webmaild] 37.151.55.184 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-20.147.135.223.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 11:21:35 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 30 11:21:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 109.161.188.201
description:
[2025-01-30 11:21:06 +0100] info [webmaild] 109.161.188.201 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
description:
2025-01-30 11:21:42 dovecot_login authenticator failed for syn-035-130-111-098.biz.spectrum.com [35.130.111.98]:35745: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.101.249.119
description:
Jan 30 11:22:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.101.249.119 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-30 11:21:43 dovecot_plain authenticator failed for ([211.106.126.27]) [211.106.126.27]:45951: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.165.137.159
description:
Jan 30 11:21:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.165.137.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.101.249.119
description:
2025-01-30 11:22:22 dovecot_login authenticator failed for p93119-obmd01.tokyo.ocn.ne.jp [124.101.249.119]:38861: 535 Incorrect authentication data (set_id=grahamyvirg@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.137.159
description:
2025-01-30 11:21:56 dovecot_plain authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [122.165.137.159]:46944: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.44.116.176
description:
[2025-01-30 11:22:07 +0100] info [webmaild] 181.44.116.176 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.36.42
description:
2025-01-30 11:22:15 dovecot_login authenticator failed for 042.36.246.220.static.netvigator.com [220.246.36.42]:57452: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.231.212.78
description:
2025-01-30 11:22:31 dovecot_login authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:61130: 535 Incorrect authentication data (set_id=grahamyvirg)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.25.36.197
description:
2025-01-30 11:23:26 dovecot_plain authenticator failed for ([37.25.36.197]) [37.25.36.197]:35235: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 11:23:38 ait sshd[845065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.145.61.134
description:
[2025-01-30 11:23:02 +0100] info [webmaild] 179.145.61.134 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.25.36.197
description:
Jan 30 11:23:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.25.36.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.150
description:
2025-01-30 11:23:36 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.150]:44815: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.121.253.62
description:
[2025-01-30 11:24:27 +0100] info [webmaild] 138.121.253.62 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 207.191.165.203
description:
[2025-01-30 11:25:05 +0100] info [webmaild] 207.191.165.203 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.99.242.32
description:
2025-01-30 11:25:18 dovecot_login authenticator failed for ([127.0.0.1]) [125.99.242.32]:57843: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.169.41.188
description:
2025-01-30 11:25:26 dovecot_login authenticator failed for ([127.0.0.1]) [113.169.41.188]:43479: 535 Incorrect authentication data (set_id=agbozume1)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.232
description:
Jan 30 11:24:46 ait sshd[845768]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.232  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.112
description:
Jan 30 11:25:05 ait sshd[846112]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.112  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.99.242.32
description:
Jan 30 11:25:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.99.242.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.169.41.188
description:
Jan 30 11:25:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.169.41.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.37.152.26
description:
2025-01-30 11:26:13 dovecot_login authenticator failed for ([127.0.0.1]) [92.37.152.26]:46422: 535 Incorrect authentication data (set_id=adom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.253.173.99
description:
Jan 30 11:25:56 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.253.173.99 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.72.62
description:
[2025-01-30 11:26:13 +0100] info [webmaild] 84.54.72.62 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-30 11:26:06 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (spichina) [81.143.51.58]:46969: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-26.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.37.152.26
description:
Jan 30 11:26:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.37.152.26 has been locked due to Imunify RBL


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 30 11:26:37 ait sshd[847009]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.173.99
description:
2025-01-30 11:25:58 dovecot_login authenticator failed for ([127.0.0.1]) [117.253.173.99]:58540: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 30 11:26:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.247.159.106
description:
Jan 30 11:27:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.247.159.106 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.31.55.119
description:
[2025-01-30 11:27:08 +0100] info [webmaild] 190.31.55.119 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.247.159.106
description:
2025-01-30 11:27:41 dovecot_plain authenticator failed for ([115.247.159.106]) [115.247.159.106]:39282: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.124.152
description:
Jan 30 11:27:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.124.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.124.152
description:
2025-01-30 11:27:50 dovecot_plain authenticator failed for ([94.207.124.152]) [94.207.124.152]:34941: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.221.212.99
description:
[2025-01-30 11:28:12 +0100] info [webmaild] 131.221.212.99 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.216
description:
Jan 30 11:28:16 ait sshd[848042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.216  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.173.204.187
description:
[2025-01-30 11:29:00 +0100] info [webmaild] 79.173.204.187 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.104.252
description:
2025-01-30 11:29:50 dovecot_login authenticator failed for 95.57.104.252.dynamic.telecom.kz [95.57.104.252]:60631: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.56.1
description:
Jan 30 11:29:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.56.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.56.1
description:
2025-01-30 11:30:01 dovecot_login authenticator failed for ([45.168.59.159]) [45.168.56.1]:41401: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.110.103.240
description:
[2025-01-30 11:30:15 +0100] info [webmaild] 176.110.103.240 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.57.104.252
description:
Jan 30 11:29:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.57.104.252 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 11:31:30 ait sshd[849966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.252.231.170
description:
[2025-01-30 11:31:09 +0100] info [webmaild] 38.252.231.170 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.18.11.94
description:
Jan 30 11:31:10 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.18.11.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.18.11.94
description:
2025-01-30 11:31:12 dovecot_login authenticator failed for ([127.0.0.1]) [37.18.11.94]:46973: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 30 11:31:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-30 11:31:19 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:50869: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.92.0
description:
[2025-01-30 11:31:58 +0100] info [webmaild] 213.230.92.0 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.11.241.139
description:
2025-01-30 11:33:15 dovecot_plain authenticator failed for ([112.11.241.139]) [112.11.241.139]:34184: 535 Incorrect authentication data (set_id=vobynuma)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.135.77.6
description:
2025-01-30 11:32:43 dovecot_plain authenticator failed for cable-24-135-77-6.dynamic.sbb.rs (matens) [24.135.77.6]:47118: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.190.153.148
description:
[2025-01-30 11:32:46 +0100] info [webmaild] 187.190.153.148 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.89.159.59
description:
Jan 30 11:33:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.89.159.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.89.159.59
description:
2025-01-30 11:33:04 dovecot_plain authenticator failed for (59-159-89-200.fibertel.com.ar) [200.89.159.59]:42332: 535 Incorrect authentication data (set_id=vobynuma@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 30 11:33:07 ait sshd[850816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.187.127.75
description:
[2025-01-30 11:34:02 +0100] info [webmaild] 45.187.127.75 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
description:
Jan 30 11:34:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 30 11:34:17 ait sshd[851574]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.181.81.77
description:
2025-01-30 11:34:31 dovecot_plain authenticator failed for ([125.181.81.77]) [125.181.81.77]:9340: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 11:33:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 11:33:54 dovecot_plain authenticator failed for (acing) [81.211.77.58]:52620: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
description:
2025-01-30 11:34:19 dovecot_plain authenticator failed for ([39.155.191.166]) [39.155.191.166]:61134: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.162.119.135
description:
[2025-01-30 11:34:57 +0100] info [webmaild] 201.162.119.135 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.216.119.211
domain: scholarship.ait-edu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-35.103.216.119.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-30 11:35:43 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:38735: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.96.96.131
description:
[2025-01-30 11:35:50 +0100] info [webmaild] 190.96.96.131 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.134.239.97
description:
Jan 30 11:35:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.134.239.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.24.117
description:
2025-01-30 11:36:05 dovecot_plain authenticator failed for ([120.202.24.117]) [120.202.24.117]:55043: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 30 11:35:41 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.134.239.97
description:
2025-01-30 11:35:54 dovecot_plain authenticator failed for ([182.134.239.97]) [182.134.239.97]:60381: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.202.24.117
description:
Jan 30 11:36:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.202.24.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.68.142
description:
[2025-01-30 11:36:41 +0100] info [webmaild] 181.46.68.142 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 11:36:42 ait sshd[852717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.126.230.85
description:
[2025-01-30 11:38:12 +0100] info [webmaild] 189.126.230.85 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.164.235.208
description:
2025-01-30 11:38:22 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:53330: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.107.193
description:
2025-01-30 11:38:47 dovecot_plain authenticator failed for ([220.180.107.193]) [220.180.107.193]:57909: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.250.213
description:
[2025-01-30 11:39:06 +0100] info [webmaild] 45.230.250.213 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-40.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-30 11:40:15 dovecot_plain authenticator failed for ([77.51.214.170]) [77.51.214.170]:60643: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.37.225.118
description:
[2025-01-30 11:40:19 +0100] info [webmaild] 179.37.225.118 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.230
description:
Jan 30 11:40:22 ait sshd[854709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.230  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 30 11:40:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 30 11:40:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 11:40:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-30 11:40:35 dovecot_plain authenticator failed for ([61.153.208.38]) [61.153.208.38]:54225: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.219.154.156
description:
2025-01-30 11:41:07 dovecot_plain authenticator failed for ([103.219.154.156]) [103.219.154.156]:40362: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.152.119.174
description:
2025-01-30 11:41:18 dovecot_plain authenticator failed for ([121.152.119.174]) [121.152.119.174]:36720: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.222.90.178
description:
Jan 30 11:40:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.222.90.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-01-30 11:40:51 dovecot_plain authenticator failed for ([61.51.184.194]) [61.51.184.194]:51984: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.19.149
description:
2025-01-30 11:41:01 dovecot_plain authenticator failed for 111-70-19-149.emome-ip.hinet.net [111.70.19.149]:49346: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.236
description:
Jan 30 11:41:04 ait sshd[854974]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.236  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.219.154.156
description:
Jan 30 11:41:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.219.154.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.222.90.178
description:
2025-01-30 11:40:50 dovecot_plain authenticator failed for ([200.222.90.178]) [200.222.90.178]:38927: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.19.149
description:
Jan 30 11:40:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.19.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.112.55.223
description:
[2025-01-30 11:41:16 +0100] info [webmaild] 103.112.55.223 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Jan 30 11:40:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.152.119.174
description:
Jan 30 11:41:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.152.119.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.110.162
description:
[2025-01-30 11:42:11 +0100] info [whostmgrd] 156.228.110.162 - ads20a00250y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.236
description:
Jan 30 11:41:51 ait sshd[855328]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.236  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.3
description:
[2025-01-30 11:42:09 +0100] info [cpaneld] 156.228.78.3 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user aitedugh (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.118.31
description:
[2025-01-30 11:42:14 +0100] info [whostmgrd] 156.228.118.31 - ads20a00250y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.212.119.219
description:
[2025-01-30 11:42:37 +0100] info [webmaild] 41.212.119.219 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.83.180
description:
[2025-01-30 11:42:06 +0100] info [cpaneld] 156.228.83.180 - ads20a00250y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00250y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.93.205
description:
[2025-01-30 11:42:10 +0100] info [cpaneld] 156.228.93.205 - ads20a00250y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00250y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.78.162
description:
[2025-01-30 11:42:12 +0100] info [whostmgrd] 156.228.78.162 - aitedugh "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.100.36
description:
[2025-01-30 11:42:12 +0100] info [whostmgrd] 156.228.100.36 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.106.33
description:
[2025-01-30 11:42:13 +0100] info [whostmgrd] 156.228.106.33 - ads20a00250y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.53.199
description:
[2025-01-30 11:42:10 +0100] info [cpaneld] 104.207.53.199 - ads20a00250y "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ads20a00250y (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 156.228.81.158
description:
[2025-01-30 11:42:11 +0100] info [whostmgrd] 156.228.81.158 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
description:
Jan 30 11:42:22 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
description:
2025-01-30 11:42:24 dovecot_plain authenticator failed for (confronma) [37.139.110.118]:39688: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 104.207.34.75
description:
[2025-01-30 11:42:07 +0100] info [cpaneld] 104.207.34.75 - ait "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ait (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-30 11:43:18 dovecot_plain authenticator failed for (couread) [65.20.183.209]:51054: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.184.209.40
description:
2025-01-30 11:43:25 dovecot_login authenticator failed for ([127.0.0.1]) [113.184.209.40]:56906: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.40.90.57
description:
[2025-01-30 11:43:34 +0100] info [webmaild] 37.40.90.57 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 30 11:43:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.184.209.40
description:
Jan 30 11:43:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.184.209.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.133.10.204
description:
Jan 30 11:43:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.133.10.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.133.10.204
description:
2025-01-30 11:43:35 dovecot_login authenticator failed for ([127.0.0.1]) [61.133.10.204]:33256: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.47
description:
2025-01-30 11:44:35 dovecot_plain authenticator failed for (smenced) [65.20.193.47]:44654: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
description:
Jan 30 11:43:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 30 11:44:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.228.200.50
description:
[2025-01-30 11:44:18 +0100] info [webmaild] 168.228.200.50 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.47
description:
Jan 30 11:44:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
description:
2025-01-30 11:43:45 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:44916: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.46
description:
2025-01-30 11:44:00 dovecot_plain authenticator failed for ([31.173.0.46]) [31.173.0.46]:51908: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.87.193.57
description:
[2025-01-30 11:45:12 +0100] info [webmaild] 103.87.193.57 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 11:45:26 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (twiss) [176.37.212.85]:44142: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 11:45:40 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (noilite) [91.56.31.167]:63732: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.37.77.175
description:
[2025-01-30 11:47:21 +0100] info [webmaild] 189.37.77.175 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.152.92.126
description:
[2025-01-30 11:47:23 +0100] info [cpaneld] 185.152.92.126 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 30 11:47:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.157.174.51
description:
Jan 30 11:47:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.157.174.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.157.174.51
description:
2025-01-30 11:47:09 dovecot_plain authenticator failed for 51.174.157.77.rev.sfr.net [77.157.174.51]:53815: 535 Incorrect authentication data (set_id=eng19b00204y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-30 11:47:02 dovecot_plain authenticator failed for ([103.29.185.162]) [103.29.185.162]:55726: 535 Incorrect authentication data (set_id=eng19b00204y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 11:47:52 ait sshd[858643]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.14.29.90
description:
[2025-01-30 11:48:19 +0100] info [webmaild] 45.14.29.90 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 30 11:49:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-30 11:49:15 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:45271: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.4.214.115
description:
Jan 30 11:49:27 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.4.214.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.4.214.115
description:
2025-01-30 11:49:29 dovecot_login authenticator failed for ([218.4.214.115]) [218.4.214.115]:37109: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 30 11:49:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.21.91.15
description:
[2025-01-30 11:49:35 +0100] info [webmaild] 5.21.91.15 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-30 11:49:38 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:65100: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.233.133.148
description:
[2025-01-30 11:48:43 +0100] info [webmaild] 179.233.133.148 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 11:49:46 ait sshd[859611]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.186.191
description:
2025-01-30 11:49:53 dovecot_login authenticator failed for m106153186191.v4.enabler.ne.jp [106.153.186.191]:47050: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.151.20.214
description:
2025-01-30 11:50:02 dovecot_plain authenticator failed for p509714d6.dip0.t-ipconnect.de (nobindepon) [80.151.20.214]:63692: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.227.66.92
description:
2025-01-30 11:50:22 dovecot_login authenticator failed for ([188.227.66.92]) [188.227.66.92]:49822: 535 Incorrect authentication data (set_id=taisiaokmar@aitopen.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 30 11:50:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-30 11:50:32 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:60532: 535 Incorrect authentication data (set_id=taisiaokmar)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.159.117.51
description:
Jan 30 11:51:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.159.117.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-30 11:51:15 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:36296: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 30 11:51:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.159.117.51
description:
2025-01-30 11:51:35 dovecot_login authenticator failed for ([127.0.0.1]) [178.159.117.51]:44887: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.183.254.183
description:
[2025-01-30 11:50:42 +0100] info [cpaneld] 5.183.254.183 - lemassne "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.237.8.37
description:
2025-01-30 11:50:53 dovecot_login authenticator failed for ([58.237.8.37]) [58.237.8.37]:50564: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.253.178
description:
2025-01-30 11:52:24 dovecot_login authenticator failed for ([116.113.253.178]) [116.113.253.178]:51384: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.134.109.253
description:
Jan 30 11:51:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.134.109.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.134.109.253
description:
2025-01-30 11:51:47 dovecot_login authenticator failed for ([127.0.0.1]) [124.134.109.253]:34612: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.237.234.118
description:
[2025-01-30 11:52:00 +0100] info [webmaild] 181.237.234.118 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.227.219.90
description:
2025-01-30 11:52:08 dovecot_plain authenticator failed for (nogiboutte) [185.227.219.90]:60238: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-30 11:52:13 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:60256: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.72.13.107
description:
[2025-01-30 11:52:59 +0100] info [webmaild] 177.72.13.107 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.242.141.190
description:
[2025-01-30 11:53:10 +0100] info [webmaild] 177.242.141.190 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.184.218.49
description:
2025-01-30 11:53:13 dovecot_plain authenticator failed for (imparhoteis.static.gvt.net.br) [179.184.218.49]:50273: 535 Incorrect authentication data (set_id=ebentil@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 30 11:53:16 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-30 11:53:18 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:63616: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.58
description:
2025-01-30 11:53:31 dovecot_login authenticator failed for ([104.241.229.58]) [104.241.229.58]:42026: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.166
description:
Jan 30 11:54:02 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
description:
2025-01-30 11:54:04 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:45081: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-30 11:54:19 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:35144: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 30 11:54:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.45.176.171
description:
2025-01-30 11:53:48 dovecot_plain authenticator failed for p388172-obmd01.tokyo.ocn.ne.jp [60.45.176.171]:54783: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.8.245
description:
Jan 30 11:53:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.8.245 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 89.237.196.201
description:
[2025-01-30 11:54:01 +0100] info [webmaild] 89.237.196.201 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.129.206.14
description:
Jan 30 11:54:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.129.206.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.8.245
description:
2025-01-30 11:53:52 dovecot_plain authenticator failed for ([65.76.8.245]) [65.76.8.245]:56338: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 30 11:54:07 ait sshd[861793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.211
description:
2025-01-30 11:54:10 dovecot_login authenticator failed for (m121-202-153-211.smartone.com) [121.202.153.211]:23112: 535 Incorrect authentication data (set_id=grahamyvirg)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.225
description:
Jan 30 11:54:18 ait sshd[861990]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.225  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.26.65.51
description:
2025-01-30 11:54:35 dovecot_plain authenticator failed for ([112.26.65.51]) [112.26.65.51]:42461: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-30 11:53:59 dovecot_plain authenticator failed for ([138.36.24.33]) [138.36.24.33]:47900: 535 Incorrect authentication data (set_id=ebentil)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 30 11:53:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-01-30 11:54:01 dovecot_login authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:38901: 535 Incorrect authentication data (set_id=grahamyvirg@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 30 11:54:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 11:55:02 ait sshd[862272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
description:
Jan 30 11:55:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 30 11:54:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-54.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.205
description:
2025-01-30 11:55:36 dovecot_plain authenticator failed for (ankels) [65.20.155.205]:34780: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.2.202
description:
Jan 30 11:56:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.172.213.166
description:
Jan 30 11:56:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.172.213.166 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.255.22.54
description:
[2025-01-30 11:56:04 +0100] info [webmaild] 131.255.22.54 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
description:
2025-01-30 11:56:05 dovecot_login authenticator failed for ([127.0.0.1]) [203.172.213.166]:35609: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.2.202
description:
2025-01-30 11:56:17 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.2.202]:47928: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-30 11:56:22 dovecot_plain authenticator failed for ([186.200.249.162]) [186.200.249.162]:53193: 535 Incorrect authentication data (set_id=zabopiqu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.36.67
description:
2025-01-30 11:56:31 dovecot_plain authenticator failed for ([203.124.36.67]) [203.124.36.67]:52946: 535 Incorrect authentication data (set_id=zabopiqu)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.42.80
description:
Jan 30 11:56:53 ait sshd[863477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.42.80  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.121.80.9
description:
[2025-01-30 11:57:01 +0100] info [webmaild] 196.121.80.9 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.170.19.98
description:
[2025-01-30 11:57:07 +0100] info [webmaild] 45.170.19.98 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.42.80
description:
Jan 30 11:56:53 ait sshd[863477]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.42.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.172.80.230
description:
[2025-01-30 11:57:58 +0100] info [webmaild] 45.172.80.230 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.190
description:
2025-01-30 11:58:17 dovecot_plain authenticator failed for (bovan) [2.110.10.190]:42006: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.134.10.18
description:
2025-01-30 11:58:39 dovecot_login authenticator failed for (188x134x10x18.static-business.spb.ertelecom.ru) [188.134.10.18]:57474: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.190
description:
Jan 30 11:58:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.134.10.18
description:
Jan 30 11:58:37 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.134.10.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.189
description:
2025-01-30 11:58:16 dovecot_plain authenticator failed for (coshpinvic) [65.20.147.189]:43063: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 11:58:20 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (kuliess) [176.37.212.85]:52008: 535 Incorrect authentication data (set_id=eng15a00111y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.147.189
description:
Jan 30 11:58:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.147.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 30 11:59:27 ait sshd[865033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.188.157.230
description:
Jan 30 11:58:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.188.157.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.153.208.38
description:
2025-01-30 11:58:49 dovecot_login authenticator failed for ([61.153.208.38]) [61.153.208.38]:40037: 535 Incorrect authentication data (set_id=iric@aitedu.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
description:
2025-01-30 11:59:00 dovecot_login authenticator failed for ([171.244.63.34]) [171.244.63.34]:43399: 535 Incorrect authentication data (set_id=iric)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 30 11:58:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.157.230
description:
2025-01-30 11:58:50 dovecot_login authenticator failed for ([207.188.157.230]) [207.188.157.230]:59290: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.2.154.126
description:
[2025-01-30 11:59:54 +0100] info [webmaild] 46.2.154.126 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.72
description:
Jan 30 12:01:04 ait sshd[866126]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.72


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.98.211
description:
[2025-01-30 12:01:08 +0100] info [webmaild] 168.232.98.211 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.203.177
description:
2025-01-30 12:01:10 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:1770: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.65.160.234
description:
Jan 30 12:01:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.65.160.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.65.160.234
description:
2025-01-30 12:01:21 dovecot_plain authenticator failed for ([124.65.160.234]) [124.65.160.234]:38307: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.115.66.179
description:
[2025-01-30 12:00:53 +0100] info [webmaild] 190.115.66.179 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.250.188.255
description:
[2025-01-30 12:01:59 +0100] info [webmaild] 191.250.188.255 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.249.179
description:
2025-01-30 12:02:47 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.249.179]:38632: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.88.234
description:
2025-01-30 12:02:49 dovecot_plain authenticator failed for ([188.59.88.234]) [188.59.88.234]:45104: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.37.177.99
description:
Jan 30 12:02:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.37.177.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.249.179
description:
Jan 30 12:02:45 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.249.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.59.88.234
description:
Jan 30 12:02:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.59.88.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.37.177.99
description:
2025-01-30 12:03:01 dovecot_login authenticator failed for syn-047-037-177-099.res.spectrum.com ([127.0.0.1]) [47.37.177.99]:36763: 535 Incorrect authentication data (set_id=ads22a00092y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-30 12:03:19 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:38649: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-30 12:03:00 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:53858: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.37.212.85
description:
2025-01-30 12:03:16 dovecot_plain authenticator failed for host-176-37-212-85.b025.la.net.ua (decaly) [176.37.212.85]:56572: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 30 12:03:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.235.88.104
description:
2025-01-30 12:03:33 dovecot_login authenticator failed for ([1.235.88.104]) [1.235.88.104]:47139: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.144.239.225
description:
Jan 30 12:04:20 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.144.239.225 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.10.18.61
description:
[2025-01-30 12:04:02 +0100] info [webmaild] 177.10.18.61 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.144.239.225
description:
2025-01-30 12:04:22 dovecot_login authenticator failed for 225.sub-166-144-239.myvzw.com [166.144.239.225]:37354: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Jan 30 12:04:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-01-30 12:04:32 dovecot_login authenticator failed for ([38.49.182.103]) [38.49.182.103]:41858: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-30 12:04:50 dovecot_plain authenticator failed for (ircianter) [81.211.77.58]:13244: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.106.126.22
description:
[2025-01-30 12:05:31 +0100] info [webmaild] 79.106.126.22 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.65.134.180
description:
Jan 30 12:05:30 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.65.134.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 30 12:04:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.54.175.40
description:
Jan 30 12:05:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.54.175.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.65.134.180
description:
2025-01-30 12:05:32 dovecot_login authenticator failed for ([127.0.0.1]) [178.65.134.180]:41777: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.206
description:
Jan 30 12:05:30 ait sshd[868877]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.206  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.41.121.60
description:
[2025-01-30 12:04:58 +0100] info [webmaild] 189.41.121.60 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.54.175.40
description:
2025-01-30 12:05:16 dovecot_login authenticator failed for ([127.0.0.1]) [95.54.175.40]:34626: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 30 12:05:51 ait sshd[869063]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.53.215.71
description:
[2025-01-30 12:06:21 +0100] info [webmaild] 177.53.215.71 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.149.154.146
description:
Jan 30 12:07:36 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.149.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.149.154.146
description:
2025-01-30 12:07:38 dovecot_login authenticator failed for ([127.0.0.1]) [103.149.154.146]:38223: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.139
description:
Jan 30 12:06:49 ait sshd[869793]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
description:
2025-01-30 12:06:56 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:42150: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.159.234.69
description:
Jan 30 12:07:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.159.234.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.234.69
description:
2025-01-30 12:07:13 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:60990: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.54.70.126
description:
2025-01-30 12:07:50 dovecot_login authenticator failed for ([127.0.0.1]) [95.54.70.126]:59650: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 30 12:08:09 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.114
description:
Jan 30 12:08:10 ait sshd[870716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.114  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.153.9.42
description:
[2025-01-30 12:08:13 +0100] info [webmaild] 190.153.9.42 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.72
description:
Jan 30 12:08:37 ait sshd[871008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.54.70.126
description:
Jan 30 12:07:48 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.54.70.126 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.110.218.100
description:
[2025-01-30 12:09:22 +0100] info [webmaild] 190.110.218.100 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-09.15.206.171.64


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.132.76
description:
[2025-01-30 12:09:10 +0100] info [webmaild] 179.125.132.76 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.101.36.159
description:
2025-01-30 12:10:08 dovecot_plain authenticator failed for ([89.101.36.159]) [89.101.36.159]:59287: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.41.47.220
description:
[2025-01-30 12:10:14 +0100] info [webmaild] 176.41.47.220 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.94.18.69
description:
2025-01-30 12:10:15 dovecot_plain authenticator failed for ([141.94.18.69]) [141.94.18.69]:37590: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.22.15.203
description:
[2025-01-30 12:11:12 +0100] info [cpaneld] 102.22.15.203 - aitext01 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.167.194.204
description:
Jan 30 12:11:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.167.194.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.167.194.204
description:
2025-01-30 12:11:23 dovecot_login authenticator failed for ([127.0.0.1]) [113.167.194.204]:53328: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.93.198
description:
Jan 30 12:11:34 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.93.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 12:11:36 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:52365: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 104.209.253.237
domain: admission.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-10.104.209.253.237


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.93.198
description:
2025-01-30 12:11:49 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.93.198]:52822: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.80.117
description:
2025-01-30 12:11:53 dovecot_login authenticator failed for ([127.0.0.1]) [178.70.80.117]:41462: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.70.80.117
description:
Jan 30 12:11:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.70.80.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.109.233
description:
[2025-01-30 12:12:30 +0100] info [webmaild] 45.169.109.233 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.179.131.55
description:
Jan 30 12:12:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.179.131.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.175.160.58
description:
Jan 30 12:13:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.175.160.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.175.160.58
description:
2025-01-30 12:13:03 dovecot_plain authenticator failed for ([117.175.160.58]) [117.175.160.58]:60506: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.59.218.28
description:
[2025-01-30 12:13:34 +0100] info [webmaild] 138.59.218.28 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.253.235.98
description:
2025-01-30 12:13:25 dovecot_login authenticator failed for ([117.253.235.98]) [117.253.235.98]:36541: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.175.146.138
description:
2025-01-30 12:12:49 dovecot_plain authenticator failed for ([60.175.146.138]) [60.175.146.138]:41414: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
description:
Jan 30 12:12:50 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.139
description:
Jan 30 12:12:53 ait sshd[873532]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.210
description:
2025-01-30 12:13:12 dovecot_login authenticator failed for ([104.241.237.210]) [104.241.237.210]:36862: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.40.116.13
description:
[2025-01-30 12:13:13 +0100] info [webmaild] 179.40.116.13 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-30 12:13:35 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:56477: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.99.14
description:
2025-01-30 12:14:02 dovecot_login authenticator failed for ([5.32.99.14]) [5.32.99.14]:42605: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.255.15.121
description:
2025-01-30 12:14:17 dovecot_login authenticator failed for ([103.255.15.121]) [103.255.15.121]:33736: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
description:
2025-01-30 12:14:21 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:56302: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.71.121.54
description:
2025-01-30 12:13:54 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:44994: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.99.14
description:
Jan 30 12:14:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.99.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.100
description:
2025-01-30 12:14:09 dovecot_login authenticator failed for (m121-202-204-100.smartone.com) [121.202.204.100]:55492: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.254.163.75
description:
[2025-01-30 12:14:24 +0100] info [webmaild] 170.254.163.75 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 30 12:14:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.100
description:
Jan 30 12:14:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.106.172.226
description:
Jan 30 12:15:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.106.172.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 30 12:15:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.72
description:
Jan 30 12:15:58 ait sshd[875698]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.72


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.106.172.226
description:
2025-01-30 12:15:27 dovecot_login authenticator failed for c-73-106-172-226.hsd1.ga.comcast.net [73.106.172.226]:42766: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-30 12:15:40 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:47308: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.75.215.245
description:
2025-01-30 12:16:20 dovecot_login authenticator failed for (nsg-static-245.215.75.182-airtel.com) [182.75.215.245]:49630: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
description:
Jan 30 12:15:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
description:
2025-01-30 12:16:07 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:42894: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
description:
2025-01-30 12:15:30 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:59093: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-30 12:15:41 dovecot_plain authenticator failed for (olosides) [109.160.123.6]:55866: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.178.242.171
description:
[2025-01-30 12:16:15 +0100] info [webmaild] 94.178.242.171 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.22.218
description:
Jan 30 12:16:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-30 12:16:39 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:46244: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
description:
2025-01-30 12:16:59 dovecot_login authenticator failed for ([203.252.10.3]) [203.252.10.3]:30897: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.71
description:
2025-01-30 12:17:08 dovecot_login authenticator failed for ([104.241.237.71]) [104.241.237.71]:60298: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 30 12:17:13 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.0.7.166
description:
[2025-01-30 12:17:13 +0100] info [webmaild] 187.0.7.166 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 30 12:16:51 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-30 12:16:53 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:34166: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-30 12:17:15 dovecot_plain authenticator failed for (unesist) [91.116.42.218]:44696: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.22.218
description:
2025-01-30 12:16:27 dovecot_plain authenticator failed for ([211.93.22.218]) [211.93.22.218]:55896: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.242.86.203
description:
2025-01-30 12:17:10 dovecot_login authenticator failed for ([58.242.86.203]) [58.242.86.203]:38827: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.252.10.3
description:
Jan 30 12:16:57 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.252.10.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.91.9.160
description:
2025-01-30 12:17:25 dovecot_plain authenticator failed for ([10.55.55.167]) [51.91.9.160]:57093: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.58.18
description:
[2025-01-30 12:17:36 +0100] info [webmaild] 37.238.58.18 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.188.78.64
description:
Jan 30 12:17:59 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.188.78.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.188.78.64
description:
2025-01-30 12:18:01 dovecot_plain authenticator failed for ool-18bc4e40.dyn.optonline.net [24.188.78.64]:53095: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
description:
2025-01-30 12:17:24 dovecot_login authenticator failed for ([111.61.175.117]) [111.61.175.117]:47924: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.66.249.234
description:
2025-01-30 12:17:52 dovecot_plain authenticator failed for 92-66-249-234.biz.kpn.net [92.66.249.234]:37278: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 152.32.187.191
description:
Jan 30 12:18:12 ait sshd[876842]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=152.32.187.191


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.21
description:
47.128.52.21 - - [30/Jan/2025:12:18:30 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=28978809 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=198%2C99%2C121&filtering=1&rating_filter=5" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.21


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.97.10
description:
2025-01-30 12:18:57 dovecot_login authenticator failed for ([116.114.97.10]) [116.114.97.10]:44387: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.22.249.36
description:
Jan 30 12:19:02 ait sshd[877401]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.22.249.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-30 12:19:13 dovecot_login authenticator failed for ([59.0.60.158]) [59.0.60.158]:46082: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.162.209.167
description:
[2025-01-30 12:18:27 +0100] info [webmaild] 103.162.209.167 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.97.10
description:
Jan 30 12:18:55 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.97.10 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.139
description:
Jan 30 12:18:57 ait sshd[877386]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.139


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.22.249.36
description:
Jan 30 12:19:02 ait sshd[877401]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.22.249.36


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 30 12:19:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.165.132.5
description:
Jan 30 12:19:21 ait sshd[877661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.165.132.5


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.95
description:
47.128.98.95 - - [30/Jan/2025:12:19:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4450767 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=198%2C118%2C120&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.95


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.174.140.6
description:
[2025-01-30 12:20:10 +0100] info [webmaild] 181.174.140.6 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.217.96
description:
Jan 30 12:19:51 ait sshd[877966]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.217.96


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.64.2.202
description:
Jan 30 12:21:11 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.64.2.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.2.14
description:
2025-01-30 12:21:02 dovecot_login authenticator failed for cm-staticip-85-152-2-14.telecable.es [85.152.2.14]:43255: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.65.201.95
description:
2025-01-30 12:21:03 dovecot_login authenticator failed for 82-65-201-95.subs.proxad.net ([127.0.0.1]) [82.65.201.95]:48600: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.83.138.102
description:
2025-01-30 12:20:48 dovecot_login authenticator failed for ([223.83.138.102]) [223.83.138.102]:56659: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.65.201.95
description:
Jan 30 12:21:01 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.65.201.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.64.2.202
description:
2025-01-30 12:21:13 dovecot_login authenticator failed for ([127.0.0.1]) [178.64.2.202]:51226: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.51.29
description:
47.128.51.29 - - [30/Jan/2025:12:20:29 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18927493 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/2/?filtering=1&level=beginner&price_type=free" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.51.29


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.83.138.102
description:
Jan 30 12:20:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.83.138.102 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.221
description:
Jan 30 12:21:01 ait sshd[878706]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.221  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.2.14
description:
Jan 30 12:21:00 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.2.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.196.243.46
description:
[2025-01-30 12:21:04 +0100] info [webmaild] 38.196.243.46 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.222
description:
Jan 30 12:21:32 ait sshd[879024]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.222  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.228.170.146
description:
[2025-01-30 12:21:31 +0100] info [webmaild] 45.228.170.146 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.29.76.99
description:
2025-01-30 12:21:46 dovecot_login authenticator failed for ([14.29.76.100]) [14.29.76.99]:46234: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.141.171.139
description:
Jan 30 12:21:40 ait sshd[879059]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.141.171.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-30 12:22:00 dovecot_login authenticator failed for ([103.207.170.28]) [103.207.170.28]:39048: 535 Incorrect authentication data (set_id=eng19a00097y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.90.150.51
description:
Jan 30 12:22:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.90.150.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 30 12:21:23 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-30 12:21:26 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:49393: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.109.1.49
description:
Jan 30 12:21:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.109.1.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 30 12:21:44 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 30 12:21:58 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 30 12:21:24 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-30 12:21:25 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:55146: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.109.1.49
description:
2025-01-30 12:21:41 dovecot_login authenticator failed for ([182.109.1.49]) [182.109.1.49]:53005: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.141.171.139
description:
Jan 30 12:21:40 ait sshd[879059]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.141.171.139


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-30 12:21:46 dovecot_login authenticator failed for ([181.197.38.12]) [181.197.38.12]:44830: 535 Incorrect authentication data (set_id=eng19a00097y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.90.150.51
description:
2025-01-30 12:22:21 dovecot_login authenticator failed for ip-109-090-150-051.um36.pools.vodafone-ip.de ([127.0.0.1]) [109.90.150.51]:54778: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.68.214.84
description:
Jan 30 12:22:28 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.68.214.84 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-23.15.206.171.64


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.31.6.109
description:
Jan 30 12:23:06 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.31.6.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.63.42.76
description:
2025-01-30 12:22:30 dovecot_login authenticator failed for ([111.63.42.76]) [111.63.42.76]:29066: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.111.146
description:
[2025-01-30 12:22:22 +0100] info [webmaild] 45.237.111.146 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.53
description:
Jan 30 12:23:15 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.53 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.22.249.36
description:
Jan 30 12:22:56 ait sshd[879686]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.22.249.36


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
description:
2025-01-30 12:22:42 dovecot_login authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:43090: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.31.6.109
description:
2025-01-30 12:23:08 dovecot_plain authenticator failed for 95-31-6-109.static.corbina.ru [95.31.6.109]:50670: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 30 12:22:31 ait sshd[879446]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.68.214.84
description:
2025-01-30 12:22:30 dovecot_login authenticator failed for ([127.0.0.1]) [178.68.214.84]:35050: 535 Incorrect authentication data (set_id=mappiah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 147.135.223.135
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-22.147.135.223.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.53
description:
2025-01-30 12:23:17 dovecot_plain authenticator failed for ([178.178.222.53]) [178.178.222.53]:43972: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-30 12:22:56 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt (boation) [89.153.62.100]:36052: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 211.149.187.182
domain: lms.aitsmartschool.com
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-22.211.149.187.182


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.249.112.157
domain: aitcourses.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-22.103.249.112.157


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
description:
Jan 30 12:22:40 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 30 12:22:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.22.249.36
description:
Jan 30 12:22:56 ait sshd[879686]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.22.249.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.217.96
description:
Jan 30 12:23:27 ait sshd[879880]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.217.96


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.165.132.5
description:
Jan 30 12:23:30 ait sshd[879890]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.165.132.5


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.155.178.39
description:
[2025-01-30 12:23:58 +0100] info [webmaild] 190.155.178.39 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.179.106
description:
2025-01-30 12:24:01 dovecot_login authenticator failed for ([222.75.179.106]) [222.75.179.106]:55451: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-30 12:24:08 dovecot_plain authenticator failed for (lavilly) [109.108.95.66]:49569: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.105.182.88
description:
2025-01-30 12:24:15 dovecot_login authenticator failed for ([222.105.182.88]) [222.105.182.88]:53018: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-30 12:25:14 dovecot_login authenticator failed for (m121-202-153-186.smartone.com) [121.202.153.186]:6484: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.22.249.36
description:
Jan 30 12:24:48 ait sshd[880718]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.22.249.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 165.22.217.96
description:
Jan 30 12:24:49 ait sshd[880732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=165.22.217.96


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.11.150
description:
[2025-01-30 12:24:53 +0100] info [webmaild] 86.108.11.150 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.241.59.150
description:
2025-01-30 12:25:00 dovecot_login authenticator failed for (static.vnpt.vn) [14.241.59.150]:46548: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 30 12:25:12 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.141.171.139
description:
Jan 30 12:24:35 ait sshd[880664]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.141.171.139 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.22.249.36
description:
Jan 30 12:24:48 ait sshd[880718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.22.249.36


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.165.132.5
description:
Jan 30 12:24:59 ait sshd[881019]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.165.132.5


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.141.171.139
description:
Jan 30 12:24:35 ait sshd[880664]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.141.171.139


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 125.22.249.36
description:
Jan 30 12:24:50 ait sshd[880718]: Failed password for invalid user test1 from 125.22.249.36 port 33958 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 30 12:24:20 ait sshd[880341]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.30.150.166
description:
2025-01-30 12:24:46 dovecot_login authenticator failed for ([119.30.150.166]) [119.30.150.166]:42240: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.52.208
description:
47.128.52.208 - - [30/Jan/2025:12:26:19 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17258301 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=183%2C99%2C79&filtering=1&instructor=1&price_type=paid" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.52.208


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.38.8.24
description:
[2025-01-30 12:25:32 +0100] info [webmaild] 186.38.8.24 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.64.20.240
description:
[2025-01-30 12:26:20 +0100] info [webmaild] 217.64.20.240 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.141.171.139
description:
Jan 30 12:27:13 ait sshd[882428]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.141.171.139 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.141.171.139
description:
Jan 30 12:27:13 ait sshd[882428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.141.171.139


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 30 12:27:49 ait sshd[882851]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.207.225.55
description:
Jan 30 12:27:29 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.207.225.55 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 37.97.228.222
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:12-27.37.97.228.222


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.183.42.7
description:
[2025-01-30 12:27:56 +0100] info [webmaild] 191.183.42.7 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 205.196.221.238
domain: admissions.ait-edu.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:12-28.205.196.221.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
description:
2025-01-30 12:27:31 dovecot_login authenticator failed for wsip-64-207-225-55.tu.ok.cox.net ([127.0.0.1]) [64.207.225.55]:43902: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.103.74
description:
2025-01-30 12:27:40 dovecot_login authenticator failed for ([127.0.0.1]) [27.72.103.74]:60109: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.103.74
description:
Jan 30 12:27:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.103.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-30 12:28:42 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (cutivacs) [91.56.31.167]:61478: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-30 12:28:46 dovecot_plain authenticator failed for (senems) [149.0.19.108]:33134: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.120.166.25
description:
[2025-01-30 12:28:53 +0100] info [webmaild] 103.120.166.25 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 30 12:29:20 ait sshd[883571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.194.233
description:
[2025-01-30 12:29:29 +0100] info [webmaild] 45.185.194.233 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-30 12:29:50 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:33208: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.82.7
description:
[2025-01-30 12:30:18 +0100] info [webmaild] 37.236.82.7 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.6.212.150
description:
2025-01-30 12:30:07 dovecot_login authenticator failed for (hebei.6.60.in-addr.arpa) [60.6.212.150]:17184: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.134.32.74
description:
Jan 30 12:30:54 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.134.32.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.134.32.74
description:
2025-01-30 12:30:56 dovecot_login authenticator failed for ([222.134.32.74]) [222.134.32.74]:32972: 535 Incorrect authentication data (set_id=ampofo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
description:
2025-01-30 12:31:07 dovecot_login authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:42864: 535 Incorrect authentication data (set_id=ampofo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.43.115.119
description:
2025-01-30 12:31:16 dovecot_plain authenticator failed for (conata.static.gvt.net.br) [177.43.115.119]:38353: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.84.5.183
description:
2025-01-30 12:31:27 dovecot_plain authenticator failed for ([210.84.5.183]) [210.84.5.183]:49581: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.238.192.121
description:
2025-01-30 12:31:57 dovecot_plain authenticator failed for host-5l.vsg1-a.v4.dfn.nl (host-5l.vsg1-a.dfn.nl) [62.238.192.121]:38492: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Jan 30 12:32:05 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.84.5.183
description:
Jan 30 12:31:25 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.84.5.183 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.82.14.170
description:
[2025-01-30 12:31:59 +0100] info [webmaild] 170.82.14.170 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-01-30 12:32:07 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:56165: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-01-30 12:32:33 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:46893: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.131
description:
Jan 30 12:32:39 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.131 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.15.98.187
description:
[2025-01-30 12:32:56 +0100] info [webmaild] 191.15.98.187 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
description:
Jan 30 12:33:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.0.126.91
description:
2025-01-30 12:33:20 dovecot_plain authenticator failed for 190-0-126-91.sanluisctv.com.ar [190.0.126.91]:41654: 535 Incorrect authentication data (set_id=bboateng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 30 12:32:46 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.131
description:
2025-01-30 12:32:41 dovecot_plain authenticator failed for ([27.40.100.131]) [27.40.100.131]:55098: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.108.234.111
description:
Jan 30 12:32:43 ait sshd[885527]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.108.234.111  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.161
description:
2025-01-30 12:32:55 dovecot_plain authenticator failed for ([112.102.48.161]) [112.102.48.161]:40232: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Jan 30 12:32:31 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-30 12:32:48 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:43022: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
description:
2025-01-30 12:33:10 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:42425: 535 Incorrect authentication data (set_id=bboateng@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.53.189
description:
47.128.53.189 - - [30/Jan/2025:12:34:13 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16084429" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.53.189


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.165.250.9
description:
[2025-01-30 12:34:20 +0100] info [webmaild] 45.165.250.9 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.162.59
description:
2025-01-30 12:34:02 dovecot_login authenticator failed for (223-197-162-59.static.imsbiz.com) [223.197.162.59]:59011: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.178.21.162
description:
Jan 30 12:34:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.178.21.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.169.197.24
description:
[2025-01-30 12:33:31 +0100] info [webmaild] 45.169.197.24 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.178.21.162
description:
2025-01-30 12:34:06 dovecot_login authenticator failed for ([123.178.21.162]) [123.178.21.162]:59210: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 30 12:33:23 ait sshd[885866]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.15.155.176
description:
2025-01-30 12:33:44 dovecot_login authenticator failed for ([203.15.155.176]) [203.15.155.176]:35174: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.179.106
description:
2025-01-30 12:34:19 dovecot_login authenticator failed for ([222.75.179.106]) [222.75.179.106]:37735: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.228
description:
Jan 30 12:35:19 ait sshd[887030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.228  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-30 12:35:40 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:34328: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.215.188.37
description:
Jan 30 12:35:43 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.215.188.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.144.33.209
description:
Jan 30 12:35:52 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.144.33.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.192.242
description:
2025-01-30 12:36:06 dovecot_login authenticator failed for ([94.204.192.242]) [94.204.192.242]:34832: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.228
description:
Jan 30 12:35:31 ait sshd[887256]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.228  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Jan 30 12:35:55 ait sshd[887592]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.217
description:
Jan 30 12:36:10 ait sshd[887741]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.217  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.20.128.218
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:12-35.51.20.128.218


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.85
description:
2025-01-30 12:35:28 dovecot_login authenticator failed for ([104.241.230.85]) [104.241.230.85]:35949: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.20.104.161
description:
Jan 30 12:35:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.20.104.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.215.188.37
description:
2025-01-30 12:35:45 dovecot_login authenticator failed for ([127.0.0.1]) [102.215.188.37]:60358: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.20.104.161
description:
2025-01-30 12:35:35 dovecot_login authenticator failed for ([127.0.0.1]) [89.20.104.161]:47928: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.192.242
description:
Jan 30 12:36:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.192.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.14.213.218
description:
[2025-01-30 12:35:54 +0100] info [webmaild] 197.14.213.218 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
description:
2025-01-30 12:35:54 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:45948: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Jan 30 12:36:41 ait sshd[887935]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.114.121
description:
47.128.114.121 - - [30/Jan/2025:12:36:41 +0100] "GET /wp-content/themes/edumall/assets/images/page-404-image.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=8275013" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.114.121


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 30 12:36:47 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.217
description:
Jan 30 12:36:23 ait sshd[887812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.217  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.195.38
description:
2025-01-30 12:36:31 dovecot_login authenticator failed for ([190.121.195.38]) [190.121.195.38]:55530: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.224.89.112
description:
2025-01-30 12:36:40 dovecot_login authenticator failed for (112.89.224.159.triolan.net) [159.224.89.112]:44526: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-01-30 12:36:49 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:46218: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.117.195.71
description:
[2025-01-30 12:36:50 +0100] info [webmaild] 103.117.195.71 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 15.206.171.64
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:12-36.15.206.171.64


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.198
description:
2025-01-30 12:36:35 dovecot_login authenticator failed for 111-70-3-198.emome-ip.hinet.net [111.70.3.198]:35466: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-30 12:36:51 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:55634: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.71.155.147
description:
[2025-01-30 12:36:53 +0100] info [webmaild] 45.71.155.147 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.199.147
description:
2025-01-30 12:37:09 dovecot_plain authenticator failed for (m121-202-199-147.smartone.com) [121.202.199.147]:44817: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.3.198
description:
Jan 30 12:36:33 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.3.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.199.147
description:
Jan 30 12:37:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.199.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.147.189
description:
2025-01-30 12:36:38 dovecot_plain authenticator failed for (grion) [65.20.147.189]:40180: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
description:
Jan 30 12:36:38 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 30 12:36:49 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.118.222
description:
47.128.118.222 - - [30/Jan/2025:12:37:26 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=22828126 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/11/?filter_course-language=121&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.118.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.252.147
description:
Jan 30 12:37:21 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.252.147 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.71.235.74
description:
[2025-01-30 12:38:18 +0100] info [webmaild] 189.71.235.74 - postmaster@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.92.181.1
description:
[2025-01-30 12:37:28 +0100] info [webmaild] 197.92.181.1 - postmaster@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 30 12:38:04 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.56
description:
47.128.98.56 - - [30/Jan/2025:12:38:03 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18819182 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C106%2C205%2C30%2C125&filtering=1&instructor=1%2C2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.56


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.252.147
description:
2025-01-30 12:37:23 dovecot_login authenticator failed for 122-148-252-147.sta.wbroadband.net.au [122.148.252.147]:36400: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
description:
2025-01-30 12:37:57 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:54906: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-30 12:38:06 dovecot_login authenticator failed for ([154.144.243.93]) [154.144.243.93]:58270: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.111.64.38
description:
2025-01-30 12:39:10 dovecot_login authenticator failed for ([176.111.64.38]) [176.111.64.38]:46036: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.111.64.38
description:
Jan 30 12:39:08 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.111.64.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 30 12:39:19 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.225.15
description:
[2025-01-30 12:39:56 +0100] info [webmaild] 37.236.225.15 - postmaster@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.227.228.136
description:
Jan 30 12:40:03 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.227.228.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.136
description:
2025-01-30 12:40:05 dovecot_login authenticator failed for ([1.227.228.136]) [1.227.228.136]:60835: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Jan 30 12:40:14 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-01-30 12:40:16 dovecot_login authenticator failed for ([183.105.138.168]) [211.35.237.38]:53795: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.170.48.178
description:
2025-01-30 12:39:52 dovecot_login authenticator failed for ([188.170.48.178]) [188.170.48.178]:45041: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 30 12:40:03 ait sshd[890101]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-30 12:39:21 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:34890: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 30 12:41:07 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Jan 30 12:41:17 ait auth[642151]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-30 12:40:31 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:35562: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.250.241
description:
2025-01-30 12:40:42 dovecot_login authenticator failed for ([31.141.250.241]) [31.141.250.241]:60588: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.13.192.74
description:
[2025-01-30 12:40:55 +0100] info [webmaild] 103.13.192.74 - postmaster@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


