# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.213.49.15
description:
2025-01-29 03:46:18 dovecot_login authenticator failed for 15.49.213.185.dynamic.electronicamartinez.es [185.213.49.15]:38718: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.133.17.20
description:
Jan 29 03:45:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.133.17.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-01-29 03:46:02 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:1239: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 03:46:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.149.83.62
description:
Jan 29 03:46:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.149.83.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.213.49.15
description:
Jan 29 03:46:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.213.49.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 29 03:46:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-29 03:46:23 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:53666: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.84.18
description:
Jan 29 03:46:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.84.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
description:
2025-01-29 03:45:58 dovecot_plain authenticator failed for (blatic) [65.20.205.197]:44503: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.84.18
description:
2025-01-29 03:46:25 dovecot_login authenticator failed for ([41.216.84.18]) [41.216.84.18]:43385: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
description:
2025-01-29 03:46:11 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:38688: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-29 03:45:34 dovecot_login authenticator failed for ([1.193.163.2]) [1.193.163.2]:58461: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.234.48.147
description:
2025-01-29 03:45:36 dovecot_login authenticator failed for ([221.234.48.147]) [221.234.48.147]:33645: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.159.234.69
description:
2025-01-29 03:45:47 dovecot_login authenticator failed for ([117.159.234.69]) [117.159.234.69]:48106: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.133.17.20
description:
2025-01-29 03:45:52 dovecot_login authenticator failed for ([120.133.17.20]) [120.133.17.20]:46746: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-29 03:46:05 dovecot_login authenticator failed for ([223.26.225.129]) [210.206.24.234]:47936: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 29 03:46:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-29 03:46:47 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:58202: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.144.33.209
description:
Jan 29 03:46:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.144.33.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-29 03:46:49 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:21063: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.157.32.129
description:
Jan 29 03:47:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.157.32.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-29 03:47:22 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:53355: 535 Incorrect authentication data (set_id=eng51a11118y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-01-29 03:47:24 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:50584: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.229
description:
2025-01-29 03:46:37 dovecot_login authenticator failed for ([104.241.229.229]) [104.241.229.229]:52189: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.45.68
description:
2025-01-29 03:46:31 dovecot_login authenticator failed for ([218.146.45.68]) [218.146.45.68]:46920: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Jan 29 03:46:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.249.131
description:
2025-01-29 03:47:00 dovecot_login authenticator failed for ([60.31.249.131]) [60.31.249.131]:44853: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 29 03:47:14 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.89.250.208
description:
Jan 29 03:47:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.89.250.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 29 03:47:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.78
description:
Jan 29 03:47:00 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.78
description:
2025-01-29 03:47:02 dovecot_login authenticator failed for ([111.61.176.78]) [111.61.176.78]:23208: 535 Incorrect authentication data (set_id=abs32a11123y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.26.98
description:
Jan 29 03:47:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.26.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.157.32.129
description:
2025-01-29 03:47:09 dovecot_plain authenticator failed for ([41.157.32.129]) [41.157.32.129]:43016: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 29 03:46:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.249.131
description:
Jan 29 03:46:58 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.249.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
description:
2025-01-29 03:46:57 dovecot_plain authenticator failed for ([106.246.6.133]) [106.246.6.133]:43600: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-29 03:47:07 dovecot_login authenticator failed for ([175.205.191.27]) [175.205.191.27]:59542: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.4.255.205
description:
Jan 29 03:47:18 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.4.255.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
description:
2025-01-29 03:46:37 dovecot_login authenticator failed for ([111.61.177.189]) [111.61.177.189]:42468: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Jan 29 03:47:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.4.255.205
description:
2025-01-29 03:47:20 dovecot_login authenticator failed for ([59.4.255.205]) [59.4.255.205]:40307: 535 Incorrect authentication data (set_id=ads61b11486y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
description:
Jan 29 03:46:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Jan 29 03:46:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-01-29 03:46:51 dovecot_login authenticator failed for ([1.237.137.30]) [1.237.137.30]:37712: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.26.98
description:
2025-01-29 03:47:09 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:46465: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.229
description:
Jan 29 03:46:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-01-29 03:46:35 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:46210: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 29 03:47:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-29 03:47:16 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:38440: 535 Incorrect authentication data (set_id=abs32a11123y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.250.208
description:
2025-01-29 03:47:21 dovecot_login authenticator failed for (mx-ll-183.89.250-208.dynamic.3bb.in.th) [183.89.250.208]:36277: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.45.68
description:
Jan 29 03:46:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.45.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
description:
2025-01-29 03:46:40 dovecot_plain authenticator failed for ([112.27.129.78]) [112.27.129.78]:52303: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.144.33.209
description:
2025-01-29 03:46:51 dovecot_login authenticator failed for ([121.144.33.209]) [121.144.33.209]:46285: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
description:
Jan 29 03:46:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
description:
Jan 29 03:46:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.205.244.221
description:
Jan 29 03:47:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.205.244.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.206.19
description:
Jan 29 03:48:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.206.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.132.19
description:
Jan 29 03:47:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.42.132.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.42.132.19
description:
2025-01-29 03:47:37 dovecot_login authenticator failed for ([111.42.132.19]) [111.42.132.19]:33910: 535 Incorrect authentication data (set_id=ads61b11486y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.226.15.135
description:
Jan 29 03:48:14 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.226.15.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.15.135
description:
2025-01-29 03:48:16 dovecot_plain authenticator failed for (static.109.226.15.135.ccc.net.il) [109.226.15.135]:54859: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.205.116
description:
Jan 29 03:47:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.205.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.205.116
description:
2025-01-29 03:47:27 dovecot_login authenticator failed for (197-255-205-116.netpagedns.net) [197.255.205.116]:54994: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.206.19
description:
2025-01-29 03:48:25 dovecot_plain authenticator failed for syn-076-176-206-019.res.spectrum.com [76.176.206.19]:64457: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.205.244.221
description:
2025-01-29 03:47:36 dovecot_login authenticator failed for (191-205-244-221.user.vivozap.com.br) [191.205.244.221]:64177: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.101
description:
2025-01-29 03:49:57 dovecot_login authenticator failed for st7013.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.101]:52982: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Jan 29 03:50:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.77
description:
Jan 29 03:50:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.77
description:
2025-01-29 03:50:22 dovecot_login authenticator failed for ([111.61.176.77]) [111.61.176.77]:35674: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-29 03:49:28 dovecot_login authenticator failed for (host-130-35-103-103.xlinkbd.net) [103.103.35.130]:43494: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.101
description:
Jan 29 03:49:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.246.138.100
description:
2025-01-29 03:50:01 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:56940: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 29 03:49:26 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.130.140.4
description:
Jan 29 03:49:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.130.140.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.204
description:
2025-01-29 03:50:13 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:55964: 535 Incorrect authentication data (set_id=bscj21bit1157y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Jan 29 03:50:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-29 03:50:23 dovecot_login authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:41360: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.53.56
description:
Jan 29 03:49:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.53.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.171.62.3
description:
Jan 29 03:49:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.171.62.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.171.62.3
description:
2025-01-29 03:49:42 dovecot_login authenticator failed for ([223.171.62.3]) [223.171.62.3]:46484: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.130.140.4
description:
2025-01-29 03:49:59 dovecot_login authenticator failed for 64-130-140-4.pool.dsl.scrtc.com [64.130.140.4]:44744: 535 Incorrect authentication data (set_id=bscj21bit1157y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 29 03:50:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 29 03:49:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-29 03:49:50 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:35056: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 03:50:20 ait sshd[4077457]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.53.56
description:
2025-01-29 03:49:42 dovecot_login authenticator failed for (undefined.hostname.localhost) [113.193.53.56]:36842: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.40.16.26
description:
Jan 29 03:50:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.40.16.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.40.16.26
description:
2025-01-29 03:50:15 dovecot_login authenticator failed for net-2-40-16-26.cust.vodafonedsl.it [2.40.16.26]:58894: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-01-29 03:50:18 dovecot_login authenticator failed for net-2-36-64-247.cust.vodafonedsl.it [2.36.64.247]:34890: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 03:50:20 ait sshd[4077457]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 29 03:49:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.246.138.100
description:
Jan 29 03:49:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.246.138.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-29 03:49:37 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:35780: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.255.207.213
description:
Jan 29 03:50:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.255.207.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-29 03:50:28 dovecot_login authenticator failed for ([221.151.168.237]) [221.151.168.237]:47522: 535 Incorrect authentication data (set_id=ads21b11212y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.139.38
description:
2025-01-29 03:51:06 dovecot_plain authenticator failed for ([59.97.139.38]) [59.97.139.38]:37677: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.98.63.18
description:
2025-01-29 03:50:58 dovecot_plain authenticator failed for ([114.98.63.18]) [114.98.63.18]:56398: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Jan 29 03:51:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-01-29 03:51:11 dovecot_login authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:57991: 535 Incorrect authentication data (set_id=eng38b22452y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.207.213
description:
2025-01-29 03:50:58 dovecot_login authenticator failed for (197-255-207-213.netpagedns.net) [197.255.207.213]:54918: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
description:
2025-01-29 03:50:37 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:37426: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.240.215.10
description:
Jan 29 03:50:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.240.215.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.240.215.10
description:
2025-01-29 03:50:38 dovecot_plain authenticator failed for ([222.240.215.10]) [222.240.215.10]:57540: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 29 03:50:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-29 03:50:52 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:56176: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.98.63.18
description:
Jan 29 03:50:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.98.63.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.97.139.38
description:
Jan 29 03:51:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.97.139.38 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-51.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-29 03:50:33 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:45060: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
description:
Jan 29 03:50:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 29 03:50:26 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 29 03:51:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-29 03:51:23 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:46507: 535 Incorrect authentication data (set_id=ads39a22282y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-50.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 29 03:50:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.30.141.222
description:
Jan 29 03:52:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.30.141.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.69.163.209
description:
2025-01-29 03:51:45 dovecot_plain authenticator failed for ([102.69.163.209]) [102.69.163.209]:44382: 535 Incorrect authentication data (set_id=paakow2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.147.155
description:
2025-01-29 03:51:54 dovecot_login authenticator failed for 155.147.48.116.static.netvigator.com [116.48.147.155]:63289: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.60.186
description:
Jan 29 03:51:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.60.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.255.143.123
description:
2025-01-29 03:51:33 dovecot_login authenticator failed for ([197.255.143.123]) [197.255.143.123]:54845: 535 Incorrect authentication data (set_id=ads76b66779y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.23.156.227
description:
Jan 29 03:52:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.23.156.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.120
description:
Jan 29 03:51:58 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.23.156.227
description:
2025-01-29 03:52:25 dovecot_login authenticator failed for ([218.23.156.227]) [218.23.156.227]:44831: 535 Incorrect authentication data (set_id=ads21b00172y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-29 03:51:29 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:47684: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Jan 29 03:51:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.175.162
description:
2025-01-29 03:51:42 dovecot_login authenticator failed for w175162.ppp.asahi-net.or.jp [121.1.175.162]:59173: 535 Incorrect authentication data (set_id=ads39a22282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 29 03:51:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.60.186
description:
2025-01-29 03:51:33 dovecot_plain authenticator failed for 42-200-60-186.static.imsbiz.com [42.200.60.186]:63698: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 29 03:51:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.120
description:
2025-01-29 03:52:00 dovecot_login authenticator failed for (m121-202-200-120.smartone.com) [121.202.200.120]:23024: 535 Incorrect authentication data (set_id=ads21b00172y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-01-29 03:51:37 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:45022: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.1.175.162
description:
Jan 29 03:51:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.1.175.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.69.163.209
description:
Jan 29 03:51:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.69.163.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-29 03:51:55 dovecot_plain authenticator failed for (20118168049.host.telemar.net.br) [200.202.250.46]:37584: 535 Incorrect authentication data (set_id=paakow2)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
description:
2025-01-29 03:52:07 dovecot_login authenticator failed for (abts-mum-static-127.120.70.182.airtelbroadband.in) [182.70.120.127]:53548: 535 Incorrect authentication data (set_id=ads21b11212y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.147.155
description:
Jan 29 03:51:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.147.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.30.141.222
description:
2025-01-29 03:52:11 dovecot_login authenticator failed for ([58.30.141.222]) [58.30.141.222]:55871: 535 Incorrect authentication data (set_id=ads76b66779y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 29 03:53:06 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.105.3.221
description:
2025-01-29 03:53:09 dovecot_login authenticator failed for ([183.105.3.221]) [183.105.3.221]:33440: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 29 03:53:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.222.244.89
description:
2025-01-29 03:53:24 dovecot_login authenticator failed for (89.244.222.60.adsl-pool.sx.cn) [60.222.244.89]:40072: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 29 03:52:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-01-29 03:52:40 dovecot_login authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:42875: 535 Incorrect authentication data (set_id=ads67a66609y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-29 03:52:37 dovecot_plain authenticator failed for ([187.76.174.254]) [187.76.174.254]:37984: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.152.234.133
description:
Jan 29 03:52:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.152.234.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-29 03:52:53 dovecot_plain authenticator failed for ([190.117.96.174]) [190.117.96.174]:59816: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.111.22
description:
2025-01-29 03:52:57 dovecot_login authenticator failed for ([110.34.111.22]) [110.34.111.22]:46713: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.135.250.242
description:
2025-01-29 03:53:23 dovecot_login authenticator failed for syn-035-135-250-242.res.spectrum.com [35.135.250.242]:57494: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 29 03:52:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 29 03:52:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-29 03:53:08 dovecot_login authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:29421: 535 Incorrect authentication data (set_id=abs61a11144y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Jan 29 03:53:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-29 03:52:34 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:40388: 535 Incorrect authentication data (set_id=abs65b11556y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 29 03:52:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-01-29 03:52:53 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:36362: 535 Incorrect authentication data (set_id=ads67a66609y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.222.244.89
description:
Jan 29 03:53:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.222.244.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.204
description:
2025-01-29 03:52:27 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:61466: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.38.85.125
description:
Jan 29 03:53:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.38.85.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.65.69.71
description:
2025-01-29 03:53:18 dovecot_login authenticator failed for ([194.65.69.71]) [194.65.69.71]:54699: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.65.69.71
description:
Jan 29 03:53:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.65.69.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-29 03:53:22 dovecot_login authenticator failed for ([169.211.232.182]) [169.211.232.182]:35818: 535 Incorrect authentication data (set_id=abs61a11144y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 29 03:52:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-29 03:52:47 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:15559: 535 Incorrect authentication data (set_id=abs65b11556y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 29 03:52:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.111.22
description:
Jan 29 03:52:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.111.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.105.3.221
description:
Jan 29 03:53:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.105.3.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.38.85.125
description:
2025-01-29 03:53:10 dovecot_login authenticator failed for (static.199.38.85.125.macminivault.com) [199.38.85.125]:62412: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-01-29 03:53:22 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:35678: 535 Incorrect authentication data (set_id=ads76a66686y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Jan 29 03:52:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.152.234.133
description:
2025-01-29 03:52:44 dovecot_login authenticator failed for ([103.152.234.133]) [103.152.234.133]:58872: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.135.250.242
description:
Jan 29 03:53:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.135.250.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-29 03:53:31 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:51422: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-29 03:53:51 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (unical) [109.67.154.24]:59238: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 29 03:53:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.237.108
description:
2025-01-29 03:54:05 dovecot_plain authenticator failed for ([218.22.237.108]) [218.22.237.108]:55178: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-29 03:54:20 dovecot_login authenticator failed for (bb128-106-196-150.singnet.com.sg) [128.106.196.150]:25341: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.37.181.181
description:
2025-01-29 03:53:32 dovecot_plain authenticator failed for ([36.37.181.181]) [36.37.181.181]:57098: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.96.133
description:
Jan 29 03:53:36 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.96.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-01-29 03:53:51 dovecot_login authenticator failed for (m121-202-152-165.smartone.com) [121.202.152.165]:53494: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.165.171
description:
2025-01-29 03:53:52 dovecot_login authenticator failed for 198-91-165-171.cpe.distributel.net [198.91.165.171]:48110: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 03:53:54 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.85.251.16
description:
2025-01-29 03:54:12 dovecot_plain authenticator failed for ([220.85.251.16]) [220.85.251.16]:36026: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.165.171
description:
Jan 29 03:53:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.165.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 29 03:54:18 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.139.142
description:
Jan 29 03:54:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.139.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.181.181
description:
Jan 29 03:53:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-01-29 03:53:40 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:49516: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
description:
Jan 29 03:53:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.96.133
description:
2025-01-29 03:53:38 dovecot_plain authenticator failed for ([61.185.96.133]) [61.185.96.133]:45610: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.62
description:
2025-01-29 03:54:22 dovecot_login authenticator failed for ([104.241.234.62]) [104.241.234.62]:57257: 535 Incorrect authentication data (set_id=abs68a66678y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Jan 29 03:53:26 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 29 03:53:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Jan 29 03:53:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-29 03:53:58 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:34722: 535 Incorrect authentication data (set_id=abs68a66678y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.85.251.16
description:
Jan 29 03:54:10 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.85.251.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.139.142
description:
2025-01-29 03:54:23 dovecot_plain authenticator failed for ([211.43.139.142]) [211.43.139.142]:45101: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-01-29 03:53:28 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:56970: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 29 03:53:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.237.108
description:
Jan 29 03:54:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.237.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.12.145.198
description:
2025-01-29 03:55:12 dovecot_login authenticator failed for ([111.12.145.198]) [111.12.145.198]:43416: 535 Incorrect authentication data (set_id=ixlqnabzu@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.20
description:
Jan 29 03:54:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Jan 29 03:54:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-54.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.204.251
description:
2025-01-29 03:54:39 dovecot_login authenticator failed for (m121-202-204-251.smartone.com) [121.202.204.251]:20293: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
description:
2025-01-29 03:54:43 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.38.21
description:
Jan 29 03:54:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.38.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-01-29 03:54:59 dovecot_login authenticator failed for ([223.241.100.90]) [223.241.100.90]:59536: 535 Incorrect authentication data (set_id=ads22a00155y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Jan 29 03:54:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
description:
2025-01-29 03:54:30 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:42890: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.20
description:
2025-01-29 03:54:44 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:33354: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-01-29 03:54:58 dovecot_login authenticator failed for (442534-test.customer.zol.co.zw) [41.190.39.142]:44978: 535 Incorrect authentication data (set_id=ads32b11283y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.12.145.198
description:
Jan 29 03:55:10 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.12.145.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.204.251
description:
Jan 29 03:54:37 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.204.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.243.166.66
description:
Jan 29 03:54:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.243.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.0.61.49
description:
2025-01-29 03:54:45 dovecot_login authenticator failed for ([27.0.61.49]) [27.0.61.49]:39318: 535 Incorrect authentication data (set_id=ads32b11283y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.38.21
description:
2025-01-29 03:54:52 dovecot_login authenticator failed for ([158.140.38.21]) [158.140.38.21]:46468: 535 Incorrect authentication data (set_id=eng19b00195y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Jan 29 03:54:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.0.61.49
description:
Jan 29 03:54:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.0.61.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Jan 29 03:55:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.38.202.60
description:
Jan 29 03:55:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.38.202.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.38.202.60
description:
2025-01-29 03:55:50 dovecot_plain authenticator failed for ([136.38.202.60]) [136.38.202.60]:48124: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.58.201.106
description:
Jan 29 03:56:01 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.58.201.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-01-29 03:55:29 dovecot_login authenticator failed for (96-79-249-93-static.hfc.comcastbusiness.net) [96.79.249.93]:50032: 535 Incorrect authentication data (set_id=ixlqnabzu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.196.64.203
description:
Jan 29 03:55:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.196.64.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.196.64.203
description:
2025-01-29 03:55:33 dovecot_plain authenticator failed for ([120.196.64.203]) [120.196.64.203]:48246: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.238.94
description:
Jan 29 03:55:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.238.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.238.94
description:
2025-01-29 03:55:43 dovecot_login authenticator failed for 186-247-238-94.user.veloxzone.com.br (186-247-238-241.user.veloxzone.com.br) [186.247.238.94]:51446: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.58.201.106
description:
2025-01-29 03:56:03 dovecot_login authenticator failed for host-5-58-201-106.bitternet.ua [5.58.201.106]:36018: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 03:57:11 ait sshd[4079967]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-01-29 03:56:28 dovecot_plain authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:28685: 535 Incorrect authentication data (set_id=ads32a00023y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.144
description:
Jan 29 03:56:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.144
description:
2025-01-29 03:56:53 dovecot_plain authenticator failed for (nsg-corporate-144.230.187.122.airtel.in) [122.187.230.144]:54498: 535 Incorrect authentication data (set_id=ads32a00023y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 03:57:11 ait sshd[4079967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 29 03:56:26 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:03-58.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 29 03:59:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 29 03:59:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 03:59:03 ait sshd[4080667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 03:59:03 ait sshd[4080667]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.145
description:
Jan 29 03:59:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 29 03:58:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 29 03:59:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ENG19A00060Y||WPU:ENG19A00060Y||RSV:6.65||T:APACHE||MV:04-00.170.205.31.106


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.222.237.145
description:
Jan 29 03:59:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.222.237.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 29 03:59:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 29 03:59:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 29 03:59:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.38.80.107
description:
Jan 29 04:01:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.38.80.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.38.80.107
description:
2025-01-29 04:01:53 dovecot_plain authenticator failed for ns3110193.ip-54-38-80.eu (ateriass) [54.38.80.107]:52348: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-01.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.209
description:
Jan 29 04:01:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
description:
2025-01-29 04:01:59 dovecot_plain authenticator failed for (uncus) [154.144.255.209]:35554: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 29 04:02:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-29 04:02:04 dovecot_plain authenticator failed for (elenes) [109.166.70.166]:26653: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.203
description:
47.128.22.203 - - [29/Jan/2025:04:02:39 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=19660066 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=183%2C79%2C198%2C120%2C99&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.158.18.129
description:
Jan 29 04:03:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.158.18.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.158.18.129
description:
2025-01-29 04:03:21 dovecot_plain authenticator failed for (trave) [94.158.18.129]:48388: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-29 04:03:58 +0100] info [whostmgrd] 212.227.201.53 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 164.90.129.81
description:
[2025-01-29 04:04:14 +0100] info [whostmgrd] 164.90.129.81 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 212.227.201.53
description:
Jan 29 04:04:19 ait sshd[4083142]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=212.227.201.53  user=lemsas


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-01-29 04:03:43 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:4449: 535 Incorrect authentication data (set_id=eng19a00060y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.227.201.53
description:
Jan 29 04:04:19 ait sshd[4083142]: pam_imunify(sshd:auth): [IM360_RBL] The IP 212.227.201.53 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads18a00007y||WPU:ads18a00007y||RSV:6.65||T:APACHE||MV:04-03.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-29 04:03:59 dovecot_plain authenticator failed for ([121.202.154.250]) [121.202.154.250]:8705: 535 Incorrect authentication data (set_id=eng19a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Jan 29 04:03:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 29 04:03:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 04:05:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 04:04:52 ait sshd[4083329]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 04:04:52 ait sshd[4083329]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.190.39.142
description:
2025-01-29 04:05:01 dovecot_plain authenticator failed for ([196.201.20.98]) [41.190.39.142]:38228: 535 Incorrect authentication data (set_id=eng09b99891@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.105
description:
2025-01-29 04:05:14 dovecot_plain authenticator failed for 111-70-49-105.emome-ip.hinet.net [111.70.49.105]:38514: 535 Incorrect authentication data (set_id=eng09b99891)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.190.39.142
description:
Jan 29 04:04:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.190.39.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.105
description:
Jan 29 04:05:12 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-29 04:06:21 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:18715: 535 Incorrect authentication data (set_id=ads17b00155y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-05.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.6.160.15
description:
Jan 29 04:06:00 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.6.160.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.6.160.15
description:
2025-01-29 04:06:02 dovecot_plain authenticator failed for ([218.6.160.15]) [218.6.160.15]:34996: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Jan 29 04:06:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 29 04:06:19 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 04:07:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.26.178.196
description:
Jan 29 04:06:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.26.178.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.158.239.144
description:
Jan 29 04:06:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.158.239.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Jan 29 04:06:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-01-29 04:06:50 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:34054: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.221.59
description:
Jan 29 04:07:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.221.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.221.59
description:
2025-01-29 04:07:15 dovecot_plain authenticator failed for (abts-north-static-059.221.160.122.airtelbroadband.in) [122.160.221.59]:54548: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.175.201.58
description:
Jan 29 04:07:30 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.175.201.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.175.201.58
description:
2025-01-29 04:07:32 dovecot_plain authenticator failed for ([59.175.201.58]) [59.175.201.58]:50208: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.157.169.242
description:
Jan 29 04:07:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.157.169.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 04:07:50 ait sshd[4084244]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 04:07:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 04:07:50 ait sshd[4084244]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.157.169.242
description:
2025-01-29 04:07:50 dovecot_plain authenticator failed for (abts-north-dynamic-161.133.176.122.airtelbroadband.in) [103.157.169.242]:36752: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Jan 29 04:08:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-01-29 04:08:42 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:55526: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 29 04:08:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-29 04:08:53 dovecot_plain authenticator failed for ([220.80.223.144]) [220.80.223.144]:55186: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 29 04:08:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-29 04:08:34 dovecot_plain authenticator failed for (bianapre) [109.166.70.166]:38819: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-29 04:09:46 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:60198: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 04:10:21 ait sshd[4085304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.197.135.208
description:
Jan 29 04:09:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.197.135.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.197.135.208
description:
2025-01-29 04:09:31 dovecot_plain authenticator failed for ([124.197.135.208]) [124.197.135.208]:60142: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 29 04:09:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 04:10:21 ait sshd[4085304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-11.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.29.100.218
description:
2025-01-29 04:11:15 dovecot_plain authenticator failed for ([60.29.100.218]) [60.29.100.218]:49571: 535 Incorrect authentication data (set_id=offei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.29.100.218
description:
Jan 29 04:11:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.29.100.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 29 04:11:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.43.238
description:
47.128.43.238 - - [29/Jan/2025:04:12:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=25305852 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/11232a?panel=events" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.43.238


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.174.147
description:
2025-01-29 04:11:31 dovecot_plain authenticator failed for (unknown.bwdc.fsg.ordnance.co) [103.79.174.147]:57405: 535 Incorrect authentication data (set_id=offei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 29 04:11:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-29 04:11:42 dovecot_plain authenticator failed for ([31.134.243.37]) [31.134.243.37]:46834: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.217.255.171
description:
Jan 29 04:11:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.217.255.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.255.171
description:
2025-01-29 04:11:58 dovecot_plain authenticator failed for ([50.217.255.171]) [50.217.255.171]:55674: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 139.99.23.122
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/2014/07/olx.php||SC:/home/ait02/public_html/wp-content/uploads/2014


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.174.147
description:
Jan 29 04:11:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.174.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.82.115.84
description:
Jan 29 04:13:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.82.115.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Jan 29 04:12:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-01-29 04:12:58 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:60583: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Jan 29 04:12:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
description:
2025-01-29 04:12:45 dovecot_plain authenticator failed for ([211.104.166.110]) [211.104.166.110]:44363: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-01-29 04:13:01 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:60322: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 04:13:18 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.83.77.10
description:
Jan 29 04:12:25 ait sshd[4085845]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.77.10  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.104.166.110
description:
Jan 29 04:12:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.104.166.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.115.84
description:
2025-01-29 04:13:13 dovecot_plain authenticator failed for ([223.82.115.84]) [223.82.115.84]:1507: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.18.31
description:
47.128.18.31 - - [29/Jan/2025:04:13:18 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23203300 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30%2C106&filter_course-language=183&filtering=1&instructor=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.18.31


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-29 04:13:34 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (ellingles) [87.103.126.54]:14787: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 29 04:13:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 29 04:13:49 ait sshd[4086465]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.20.197
description:
Jan 29 04:14:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.20.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.20.197
description:
2025-01-29 04:14:05 dovecot_plain authenticator failed for ([65.76.20.197]) [65.76.20.197]:49326: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Jan 29 04:14:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-01-29 04:14:24 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:27770: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 29 04:13:49 ait sshd[4086465]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 51.83.77.10
description:
Jan 29 04:14:48 ait sshd[4086751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=51.83.77.10  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 29 04:15:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.209.247.54
description:
Jan 29 04:16:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.209.247.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 04:16:21 ait sshd[4087444]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.247.54
description:
2025-01-29 04:16:22 dovecot_plain authenticator failed for ([82.209.247.54]) [82.209.247.54]:54960: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-15.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-29 04:15:51 dovecot_plain authenticator failed for (throdeless) [102.53.15.18]:34311: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 04:16:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 04:16:21 ait sshd[4087444]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.13.67.132
description:
Jan 29 04:17:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.13.67.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.144.16.16
description:
Jan 29 04:17:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.144.16.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.144.16.16
description:
2025-01-29 04:17:11 dovecot_plain authenticator failed for ([219.144.16.16]) [219.144.16.16]:35481: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.225.215.173
description:
Jan 29 04:17:16 ait sshd[4087694]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.225.215.173


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 29 04:16:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.77.215.124
description:
Jan 29 04:16:35 ait sshd[4087477]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.77.215.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-29 04:16:31 dovecot_plain authenticator failed for (groffash) [109.166.70.166]:2854: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.77.215.124
description:
Jan 29 04:16:35 ait sshd[4087477]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.77.215.124  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.24
description:
Jan 29 04:17:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.24
description:
2025-01-29 04:17:22 dovecot_plain authenticator failed for (nsg-corporate-24.227.187.122.airtel.in) [122.187.227.24]:45680: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 04:16:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.13.67.132
description:
2025-01-29 04:17:09 dovecot_plain authenticator failed for ([221.13.67.132]) [221.13.67.132]:47723: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.225.215.173
description:
Jan 29 04:17:16 ait sshd[4087694]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.225.215.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.117.91.67
description:
Jan 29 04:19:17 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.117.91.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.117.91.67
description:
2025-01-29 04:19:19 dovecot_plain authenticator failed for ([220.117.91.67]) [220.117.91.67]:52422: 535 Incorrect authentication data (set_id=ads21b00202y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Jan 29 04:19:00 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-01-29 04:19:02 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:54272: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.172.120.32
description:
2025-01-29 04:19:50 dovecot_plain authenticator failed for ([111.172.120.32]) [111.172.120.32]:40250: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.68
description:
Jan 29 04:19:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-01-29 04:20:04 dovecot_plain authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:48711: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 04:20:20 ait sshd[4088965]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 29 04:19:54 ait sshd[4088555]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.10.127.167
description:
Jan 29 04:20:06 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.10.127.167 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ug21s1150030||WPU:ug21s1150030||RSV:6.65||T:APACHE||MV:04-19.170.205.31.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.172.120.32
description:
Jan 29 04:19:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.172.120.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 29 04:19:54 ait sshd[4088555]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.68
description:
2025-01-29 04:19:54 dovecot_plain authenticator failed for ([144.48.49.68]) [144.48.49.68]:33639: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.10.127.167
description:
2025-01-29 04:20:08 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:38525: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.220.167.38
description:
Jan 29 04:20:14 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.220.167.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
description:
2025-01-29 04:20:16 dovecot_plain authenticator failed for ([223.220.167.38]) [223.220.167.38]:45704: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 04:20:20 ait sshd[4088965]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 29 04:21:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 04:20:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-21.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 29 04:21:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-29 04:21:09 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (hydest) [51.255.84.180]:57292: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.175.13
description:
Jan 29 04:22:13 ait sshd[4089539]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.175.13  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-01-29 04:22:23 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2204: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-29 04:21:26 dovecot_plain authenticator failed for (famans) [164.92.243.206]:57340: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.235.152
description:
Jan 29 04:21:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.235.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.235.152
description:
2025-01-29 04:21:54 dovecot_plain authenticator failed for ([218.149.235.152]) [218.149.235.152]:39390: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Ads22a00144y||WPU:Ads22a00144y||RSV:6.65||T:APACHE||MV:04-21.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.66.228.194
description:
2025-01-29 04:22:03 dovecot_plain authenticator failed for bb115-66-228-194.singnet.com.sg [115.66.228.194]:32793: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 29 04:21:58 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.66.228.194
description:
Jan 29 04:22:01 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.66.228.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-29 04:22:00 dovecot_plain authenticator failed for ([183.99.89.74]) [183.99.89.74]:34326: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Jan 29 04:22:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 04:22:27 ait sshd[4089580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
description:
Jan 29 04:22:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.61.95
description:
2025-01-29 04:23:17 dovecot_plain authenticator failed for h77-53-61-95.cust.bredband2.com [77.53.61.95]:41009: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-01-29 04:23:23 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:46322: 535 Incorrect authentication data (set_id=abs20a00063y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.200.218
description:
Jan 29 04:23:09 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.200.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.200.218
description:
2025-01-29 04:23:11 dovecot_plain authenticator failed for ([121.202.200.218]) [121.202.200.218]:19605: 535 Incorrect authentication data (set_id=abs20a00063y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Jan 29 04:23:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.50
description:
Jan 29 04:22:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.87.251
description:
Jan 29 04:22:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.87.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.177.61
description:
2025-01-29 04:22:36 dovecot_plain authenticator failed for (61-177-53-194.mairnet.net) [194.53.177.61]:44574: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-01-29 04:22:47 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:45985: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.87.251
description:
2025-01-29 04:22:49 dovecot_plain authenticator failed for ([183.234.87.251]) [183.234.87.251]:60209: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.53.61.95
description:
Jan 29 04:23:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.53.61.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 04:22:27 ait sshd[4089580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.177.61
description:
Jan 29 04:22:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.177.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.50
description:
2025-01-29 04:22:35 dovecot_plain authenticator failed for ([178.178.222.50]) [178.178.222.50]:47050: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.215.41.28
description:
Jan 29 04:23:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.215.41.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 04:24:06 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 29 04:23:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-29 04:23:31 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:56614: 535 Incorrect authentication data (set_id=eng27b00340y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 29 04:24:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-29 04:24:45 dovecot_plain authenticator failed for ([121.202.155.240]) [121.202.155.240]:23275: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 04:24:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.118.229
description:
Jan 29 04:24:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.118.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.118.229
description:
2025-01-29 04:24:34 dovecot_plain authenticator failed for ([138.75.118.229]) [138.75.118.229]:57551: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-29 04:25:35 dovecot_plain authenticator failed for ([189.56.79.105]) [186.200.249.162]:46327: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-26.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 29 04:25:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.180
description:
Jan 29 04:25:49 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.180
description:
2025-01-29 04:25:51 dovecot_plain authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:44917: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-01-29 04:27:05 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:58882: 535 Incorrect authentication data (set_id=sates1@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.252.8.34
description:
2025-01-29 04:27:18 dovecot_plain authenticator failed for ([43.252.8.34]) [43.252.8.34]:55706: 535 Incorrect authentication data (set_id=sates1)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 04:26:33 ait sshd[4091210]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Jan 29 04:27:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.252.8.34
description:
Jan 29 04:27:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.252.8.34 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 04:26:33 ait sshd[4091210]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 04:26:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads18b00152y||WPU:ads18b00152y||RSV:6.65||T:APACHE||MV:04-26.170.205.31.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 04:27:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.175.13
description:
Jan 29 04:26:56 ait sshd[4091030]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.175.13  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 04:27:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.238.90
description:
Jan 29 04:28:02 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.238.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
description:
Jan 29 04:27:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-27.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.123.53.43
description:
Jan 29 04:27:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.123.53.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.123.53.43
description:
2025-01-29 04:27:36 dovecot_plain authenticator failed for ([36.32.223.199]) [112.123.53.43]:20661: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.118.162.194
description:
Jan 29 04:28:10 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.118.162.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.238.90
description:
2025-01-29 04:28:04 dovecot_plain authenticator failed for ([122.187.147.17]) [128.185.238.90]:59578: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.118.162.194
description:
2025-01-29 04:28:12 dovecot_plain authenticator failed for ([154.118.162.194]) [154.118.162.194]:34102: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
description:
2025-01-29 04:27:59 dovecot_plain authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:59476: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.174.229.206
description:
2025-01-29 04:28:45 dovecot_plain authenticator failed for ([93.174.229.206]) [93.174.229.206]:37448: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.111.61.229
description:
2025-01-29 04:28:56 dovecot_plain authenticator failed for ([112.111.61.231]) [112.111.61.229]:50508: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.111.61.229
description:
Jan 29 04:28:54 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.111.61.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 04:28:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.174.229.206
description:
Jan 29 04:28:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.174.229.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 29 04:29:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-29 04:29:07 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:37558: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.44.67.28
description:
Jan 29 04:29:26 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.44.67.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.207.188.2
description:
Jan 29 04:29:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.207.188.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.87.122
description:
2025-01-29 04:30:08 dovecot_plain authenticator failed for ([2.54.87.122]) [2.54.87.122]:47933: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.92.61.242
description:
Jan 29 04:29:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.92.61.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.188.2
description:
2025-01-29 04:29:49 dovecot_plain authenticator failed for ([102.207.188.2]) [102.207.188.2]:59980: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.93.240.115
description:
Jan 29 04:29:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.93.240.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.249.93
description:
Jan 29 04:29:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.249.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.87.122
description:
Jan 29 04:30:06 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.87.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.44.67.28
description:
2025-01-29 04:29:28 dovecot_plain authenticator failed for (psene) [185.44.67.28]:48700: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.92.61.242
description:
2025-01-29 04:29:30 dovecot_plain authenticator failed for ([222.92.61.242]) [222.92.61.242]:37257: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.249.93
description:
2025-01-29 04:29:59 dovecot_plain authenticator failed for ([96.79.249.93]) [96.79.249.93]:46942: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.93.240.115
description:
2025-01-29 04:29:58 dovecot_plain authenticator failed for ([36.93.240.115]) [36.93.240.115]:32872: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 04:30:37 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.94.179.104
description:
Jan 29 04:31:14 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.94.179.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.94.179.104
description:
2025-01-29 04:31:16 dovecot_plain authenticator failed for ([23.94.179.104]) [23.94.179.104]:42932: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.199.183.172
description:
Jan 29 04:31:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.199.183.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.208.108.52
description:
Jan 29 04:31:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.208.108.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 04:32:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
description:
Jan 29 04:31:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
description:
2025-01-29 04:31:29 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:41949: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.183.172
description:
2025-01-29 04:31:30 dovecot_plain authenticator failed for (172.183.199.112.unknown.m1.com.sg) [112.199.183.172]:38930: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.208.108.52
description:
2025-01-29 04:31:44 dovecot_plain authenticator failed for ([60.208.108.52]) [60.208.108.52]:41648: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-31.194.163.182.227


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.98.49
description:
47.128.98.49 - - [29/Jan/2025:04:32:48 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=18473244 HTTP/1.1" 302 0 www.aitedu.us "http://www.aitedu.us/spcp/index.php?Itemid=102&id=47&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.98.49


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 120.224.156.84
domain: 136.243.145.84:80
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:04-33.120.224.156.84||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-29 04:33:53 dovecot_plain authenticator failed for ([94.102.51.218]) [94.102.51.218]:13432: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 29 04:34:04 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-29 04:34:06 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:39942: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 04:33:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.231.84.13
description:
2025-01-29 04:33:46 dovecot_plain authenticator failed for ([116.231.84.13]) [116.231.84.13]:54618: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 29 04:33:51 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.187.66.166
description:
Jan 29 04:34:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.187.66.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.231.84.13
description:
Jan 29 04:33:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.231.84.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Jan 29 04:33:54 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-01-29 04:33:56 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:38733: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 04:35:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Ads15a00028y||WPU:Ads15a00028y||RSV:6.65||T:APACHE||MV:04-35.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
description:
2025-01-29 04:36:09 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:53564: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Jan 29 04:36:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.60.13
description:
Jan 29 04:36:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.60.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 04:36:37 ait sshd[4095033]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 04:36:37 ait sshd[4095033]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-36.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.60.13
description:
2025-01-29 04:36:27 dovecot_plain authenticator failed for ([112.196.60.13]) [112.196.60.13]:44374: 535 Incorrect authentication data (set_id=botchway)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 90.156.142.68
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-38.90.156.142.68


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.106
domain: lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:PG20S2080028||WPU:PG20S2080028||RSV:6.65||T:APACHE||MV:04-37.170.205.31.106


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
description:
2025-01-29 04:37:30 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:58298: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 154.161.171.33
domain: lemsas.net
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:Zmzg||MV:2117 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 29 04:37:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-29 04:37:41 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:41540: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: modsec
rule: 77350223
name: IM360 WAF: Common SQLi
abuser: 154.161.171.33
domain: lemsas.net
description:
IM360 WAF: Common SQLi||MVN:ARGS:Zmzg||MV:2117 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1||RSV:6.65||T:APACHE||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 154.161.171.33
domain: lemsas.net
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:Zmzg||MV:2117 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert(\"XSS\")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.122.196.230
description:
Jan 29 04:38:14 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.122.196.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.162
description:
Jan 29 04:37:28 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.95
description:
2025-01-29 04:37:59 dovecot_plain authenticator failed for (95-179-53-194.mairnet.net) [194.53.179.95]:34520: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
description:
2025-01-29 04:38:10 dovecot_plain authenticator failed for ([151.192.57.118]) [151.192.57.118]:38710: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.192.57.118
description:
Jan 29 04:38:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.192.57.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.122.196.230
description:
2025-01-29 04:38:16 dovecot_plain authenticator failed for ([118.122.196.230]) [118.122.196.230]:38709: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.95
description:
Jan 29 04:37:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 29 04:39:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.203.251.186
description:
Jan 29 04:38:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.203.251.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.203.251.186
description:
2025-01-29 04:39:01 dovecot_plain authenticator failed for ([119.203.251.186]) [119.203.251.186]:54844: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.175.194.139
description:
Jan 29 04:38:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.175.194.139 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.32.240
description:
47.128.32.240 - - [29/Jan/2025:04:38:49 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=20068971 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/7/?filtering=1&instructor=2&level=all_levels" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.32.240


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.225.8
description:
Jan 29 04:39:15 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.225.8 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 5.160.247.200
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-38.5.160.247.200


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.85.42.195
description:
Jan 29 04:39:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.85.42.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.225.8
description:
2025-01-29 04:39:17 dovecot_plain authenticator failed for ([5.30.225.8]) [5.30.225.8]:36525: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.175.194.139
description:
2025-01-29 04:38:29 dovecot_plain authenticator failed for syn-072-175-194-139.res.spectrum.com [72.175.194.139]:64792: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.60.82.26
description:
2025-01-29 04:39:10 dovecot_plain authenticator failed for (ftth-139-60-82-26.hamiltoncom.net) [139.60.82.26]:43011: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.85.42.195
description:
2025-01-29 04:39:15 dovecot_plain authenticator failed for ([1.85.42.195]) [1.85.42.195]:51703: 535 Incorrect authentication data (set_id=eng21a00038y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-29 04:40:01 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:44253: 535 Incorrect authentication data (set_id=ait@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-29 04:39:26 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:38424: 535 Incorrect authentication data (set_id=eng21a00038y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.238.31.114
description:
Jan 29 04:39:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.238.31.114 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 04:39:40 ait sshd[4096107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.129.195
description:
Jan 29 04:40:16 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.129.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 29 04:39:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 29 04:40:05 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 04:39:40 ait sshd[4096107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.16.4
description:
Jan 29 04:39:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.16.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.130.135.194
description:
Jan 29 04:39:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.130.135.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-29 04:40:07 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:56956: 535 Incorrect authentication data (set_id=ait)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.16.4
description:
2025-01-29 04:39:50 dovecot_plain authenticator failed for ([149.0.16.4]) [149.0.16.4]:42442: 535 Incorrect authentication data (set_id=ads20a00141y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.189
description:
Jan 29 04:39:58 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.129.195
description:
2025-01-29 04:40:18 dovecot_plain authenticator failed for 198-91-129-195.cpe.distributel.net [198.91.129.195]:58204: 535 Incorrect authentication data (set_id=ads20a00141y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 04:41:10 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 29 04:40:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.243.195
description:
Jan 29 04:40:32 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.243.195 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-42.194.163.182.227


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 154.161.171.33
domain: lemsas.net
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:DirBuster-1.0-RC1 (http://www.owasp.org/index.php/Category:OWASP_DirBuster_Project)||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.165.140
description:
2025-01-29 04:44:42 dovecot_plain authenticator failed for ([103.250.160.76]) [117.198.165.140]:39212: 535 Incorrect authentication data (set_id=assdas2)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.19.166
description:
47.128.19.166 - - [29/Jan/2025:04:45:10 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=21726292 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-language=121%2C95&instructor=1%2C2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.19.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.16.150.212
description:
Jan 29 04:44:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.16.150.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.16.150.212
description:
2025-01-29 04:44:33 dovecot_plain authenticator failed for ([219.140.170.34]) [27.16.150.212]:60533: 535 Incorrect authentication data (set_id=assdas2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 04:44:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.165.140
description:
Jan 29 04:44:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.165.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-29 04:45:52 dovecot_plain authenticator failed for ([89.211.42.163]) [37.186.40.110]:38539: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.71.191.43
description:
Jan 29 04:46:07 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.71.191.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.71.191.43
description:
2025-01-29 04:46:09 dovecot_plain authenticator failed for ([1.71.191.42]) [1.71.191.43]:45246: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 04:45:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 29 04:45:50 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.178
description:
Jan 29 04:46:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 04:46:23 ait sshd[4098625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 04:46:23 ait sshd[4098625]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 170.205.31.125
domain: www.lemsas.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:missionuds||WPU:missionuds||RSV:6.65||T:APACHE||MV:04-47.170.205.31.125


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.178
description:
Jan 29 04:46:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.240.117.170
description:
Jan 29 04:46:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.240.117.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 29 04:47:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-29 04:47:24 dovecot_plain authenticator failed for ([200.141.225.73]) [200.149.54.14]:44106: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.250.149.90
description:
Jan 29 04:47:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.250.149.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.90
description:
2025-01-29 04:47:35 dovecot_plain authenticator failed for ([110.226.126.143]) [103.250.149.90]:42112: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.153.208.38
description:
Jan 29 04:47:57 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.153.208.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.129
description:
Jan 29 04:48:23 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.129
description:
2025-01-29 04:48:25 dovecot_plain authenticator failed for ([112.102.48.129]) [112.102.48.129]:36833: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-48.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.15.51.15
description:
Jan 29 04:48:27 ait sshd[4099269]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.15.51.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.3.133.47
description:
Jan 29 04:48:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.3.133.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.3.133.47
description:
2025-01-29 04:48:45 dovecot_plain authenticator failed for ([183.3.133.47]) [183.3.133.47]:38067: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Jan 29 04:49:08 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.15.51.15
description:
Jan 29 04:48:27 ait sshd[4099269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.15.51.15  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.42.245.153
description:
Jan 29 04:48:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.42.245.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
description:
Jan 29 04:50:00 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 29 04:50:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Jan 29 04:49:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.152.91.221
description:
2025-01-29 04:49:35 dovecot_plain authenticator failed for ([124.152.91.221]) [124.152.91.221]:53198: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.11.126
description:
Jan 29 04:49:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.11.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.11.126
description:
2025-01-29 04:49:57 dovecot_plain authenticator failed for ([220.182.11.126]) [220.182.11.126]:44582: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.152.91.221
description:
Jan 29 04:49:33 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.152.91.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 04:49:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.188.114.231
description:
Jan 29 04:50:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.188.114.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.108.186.10
description:
Jan 29 04:50:45 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.108.186.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.60.146
description:
Jan 29 04:50:55 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.132.2
description:
2025-01-29 04:50:42 dovecot_plain authenticator failed for vps-6186bf6b.vps.ovh.net [57.129.132.2]:51038: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.108.186.10
description:
2025-01-29 04:50:47 dovecot_plain authenticator failed for (videoifolder.ru) [78.108.186.10]:53958: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 04:50:52 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.15.51.15
description:
Jan 29 04:51:06 ait sshd[4100414]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.15.51.15 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.15.51.15
description:
Jan 29 04:51:06 ait sshd[4100414]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.15.51.15


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 29 04:50:23 ait sshd[4100141]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.188.114.231
description:
2025-01-29 04:50:26 dovecot_plain authenticator failed for ([90.188.114.231]) [90.188.114.231]:43265: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.129.132.2
description:
Jan 29 04:50:40 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.129.132.2 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 29 04:50:23 ait sshd[4100141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 29 04:50:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-01-29 04:50:57 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:37714: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.213.211
description:
Jan 29 04:51:10 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.213.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.213.211
description:
Jan 29 04:51:25 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.213.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 29 04:51:44 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.174.252.131
description:
Jan 29 04:52:00 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.174.252.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.168.173.87
description:
Jan 29 04:52:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.168.173.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 129.222.28.111
description:
Jan 29 04:52:18 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 129.222.28.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 29 04:51:29 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.3
description:
Jan 29 04:51:35 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-29 04:51:46 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:12743: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.174.252.131
description:
2025-01-29 04:52:02 dovecot_plain authenticator failed for ([39.174.252.131]) [39.174.252.131]:46246: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 04:53:14 ait sshd[4101137]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 29 04:53:21 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-29 04:53:23 dovecot_plain authenticator failed for (unryning) [37.224.119.19]:33392: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 04:52:39 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 29 04:52:40 ait sshd[4100897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 04:52:41 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:45176: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 29 04:52:40 ait sshd[4100897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 04:53:14 ait sshd[4101137]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.222.80.77
description:
Jan 29 04:53:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.222.80.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-29 04:54:20 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (cardion) [94.45.76.149]:46000: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.222.80.77
description:
Jan 29 04:53:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.222.80.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.99.36.130
description:
Jan 29 04:53:41 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.99.36.130 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-53.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 04:54:02 ait sshd[4101350]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 04:54:02 ait sshd[4101350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 29 04:54:18 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.59.53
description:
Jan 29 04:54:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.59.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.59.53
description:
2025-01-29 04:54:50 dovecot_plain authenticator failed for ([185.167.59.53]) [185.167.59.53]:37580: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.181.41.120
description:
Jan 29 04:54:56 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.181.41.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.181.41.120
description:
2025-01-29 04:54:58 dovecot_plain authenticator failed for ([185.181.41.120]) [185.181.41.120]:49982: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.62.95
description:
47.128.62.95 - - [29/Jan/2025:04:55:47 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=16698093 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C106%2C205%2C30&filter_course-language=79%2C183&filtering=1&instructor=2%2C1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.62.95


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.243.7.50
description:
Jan 29 04:55:48 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.243.7.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.243.7.50
description:
2025-01-29 04:55:50 dovecot_plain authenticator failed for ([203.243.7.50]) [203.243.7.50]:34619: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.156.44
description:
2025-01-29 04:56:17 dovecot_plain authenticator failed for p247044-obmd01.tokyo.ocn.ne.jp [153.141.156.44]:41936: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.90.34.32
description:
Jan 29 04:56:22 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.90.34.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.90.34.32
description:
2025-01-29 04:56:24 dovecot_plain authenticator failed for syn-071-090-034-032.res.spectrum.com [71.90.34.32]:58193: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
description:
Jan 29 04:56:42 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.159.57.4
description:
2025-01-29 04:56:55 dovecot_plain authenticator failed for ([219.159.57.4]) [219.159.57.4]:47137: 535 Incorrect authentication data (set_id=eng19b00160y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.210.105.166
description:
Jan 29 04:56:59 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.210.105.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.33.27.114
description:
Jan 29 04:57:11 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.33.27.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.33.27.114
description:
2025-01-29 04:57:13 dovecot_plain authenticator failed for (114.27.33.36.adsl-pool.ah.cnuninet.net) [36.33.27.114]:34600: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 29 04:57:20 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 04:56:38 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
description:
2025-01-29 04:56:44 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:59030: 535 Incorrect authentication data (set_id=eng19b00160y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.159.57.4
description:
Jan 29 04:56:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.159.57.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-29 04:57:22 dovecot_plain authenticator failed for ([103.207.170.28]) [103.207.170.28]:41454: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.160.139.163
description:
Jan 29 04:56:34 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.160.139.163 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 4.153.178.110
domain: ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:04-57.4.153.178.110


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-59.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.20.130
description:
2025-01-29 04:59:15 dovecot_plain authenticator failed for ([123.212.20.130]) [123.212.20.130]:50418: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.63.136.218
description:
2025-01-29 04:58:29 dovecot_login authenticator failed for ([183.63.136.218]) [183.63.136.218]:50322: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.20.146
description:
Jan 29 04:58:37 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.20.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.221.130.246
description:
Jan 29 04:58:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.221.130.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.130.246
description:
2025-01-29 04:58:49 dovecot_plain authenticator failed for ([211.221.130.246]) [211.221.130.246]:37700: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.63.136.218
description:
Jan 29 04:58:27 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.63.136.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.20.146
description:
2025-01-29 04:58:39 dovecot_login authenticator failed for ([31.173.20.146]) [31.173.20.146]:58390: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.20.130
description:
Jan 29 04:59:13 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.252.152.214
description:
Jan 29 05:00:03 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.252.152.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.252.152.214
description:
2025-01-29 05:00:05 dovecot_plain authenticator failed for ([193.252.152.214]) [193.252.152.214]:36904: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Jan 29 04:59:31 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-01-29 04:59:33 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:42944: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.8.22.14
description:
Jan 29 04:59:47 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.8.22.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.8.22.14
description:
2025-01-29 04:59:49 dovecot_plain authenticator failed for (14.22.8.221.adsl-pool.jlccptt.net.cn) [221.8.22.14]:57495: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Jan 29 05:00:24 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-01-29 05:00:26 dovecot_plain authenticator failed for ([183.196.174.235]) [183.196.174.235]:49821: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.35.199.239
description:
Jan 29 05:02:43 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.35.199.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.35.199.239
description:
2025-01-29 05:02:45 dovecot_plain authenticator failed for ([89.35.199.239]) [89.35.199.239]:40250: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.180.50
description:
Jan 29 05:02:53 ait auth[3980984]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.180.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.180.50
description:
2025-01-29 05:02:55 dovecot_plain authenticator failed for ([124.114.180.50]) [124.114.180.50]:52470: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 05:03:14 ait sshd[4104587]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 05:03:14 ait sshd[4104587]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-05.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 05:05:20 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-04.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.53.85.222
description:
Jan 29 05:05:33 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.53.85.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.53.85.222
description:
2025-01-29 05:05:35 dovecot_plain authenticator failed for itau-g2-0-2-150618-iacc01.rce.embratel.net.br [189.53.85.222]:56263: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.133.182
description:
Jan 29 05:05:45 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.133.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-29 05:05:47 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:56711: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 29 05:06:19 ait sshd[4105752]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 29 05:06:19 ait sshd[4105752]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 05:07:05 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.211.3
description:
2025-01-29 05:07:25 dovecot_plain authenticator failed for 82-64-211-3.subs.proxad.net [82.64.211.3]:34620: 535 Incorrect authentication data (set_id=ug20s1120028@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.68.12.96
description:
Jan 29 05:07:00 ait sshd[4106011]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.68.12.96 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.68.12.96
description:
[2025-01-29 05:07:00 +0100] info [whostmgrd] 77.68.12.96 - lemsas "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.68.12.96
description:
Jan 29 05:07:00 ait sshd[4106011]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.68.12.96  user=lemsas


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.64.211.3
description:
Jan 29 05:07:23 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.64.211.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.232.69.200
description:
Jan 29 05:07:30 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.232.69.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 29 05:07:56 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.232.69.200
description:
2025-01-29 05:07:32 dovecot_plain authenticator failed for ([178.232.69.200]) [178.232.69.200]:53740: 535 Incorrect authentication data (set_id=ug20s1120028)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.63
description:
Jan 29 05:07:37 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.63 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.63
description:
2025-01-29 05:07:39 dovecot_plain authenticator failed for (m121-202-154-63.smartone.com) [121.202.154.63]:5088: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.190
description:
Jan 29 05:07:56 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-29 05:07:58 dovecot_plain authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:59892: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.190
description:
2025-01-29 05:07:58 dovecot_plain authenticator failed for (percheing) [2.110.10.190]:33246: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 29 05:08:44 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.117.144.158
description:
Jan 29 05:09:22 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.117.144.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.2
description:
Jan 29 05:09:23 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.238.224.190
description:
Jan 29 05:08:32 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.238.224.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.117.144.158
description:
2025-01-29 05:09:24 dovecot_plain authenticator failed for ([175.117.144.158]) [175.117.144.158]:54124: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.238.224.190
description:
2025-01-29 05:08:34 dovecot_plain authenticator failed for ([115.238.224.190]) [115.238.224.190]:48369: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-29 05:08:46 dovecot_plain authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:59644: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.2
description:
2025-01-29 05:09:25 dovecot_plain authenticator failed for ([203.189.124.2]) [203.189.124.2]:51419: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 05:09:00 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Jan 29 05:09:16 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-01-29 05:09:18 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:57602: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
description:
Jan 29 05:09:32 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
description:
Jan 29 05:09:42 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.206.101.19
description:
Jan 29 05:09:46 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.206.101.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-29 05:09:39 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:42522: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.206.101.19
description:
2025-01-29 05:09:48 dovecot_plain authenticator failed for dslb-002-206-101-019.002.206.pools.vodafone-ip.de (taing) [2.206.101.19]:35450: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
description:
Jan 29 05:09:26 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
description:
2025-01-29 05:09:34 dovecot_plain authenticator failed for ([41.214.10.178]) [41.214.10.178]:59336: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 29 05:09:37 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
description:
2025-01-29 05:09:28 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:37674: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
description:
2025-01-29 05:09:44 dovecot_plain authenticator failed for (screte) [82.193.122.91]:32960: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 05:10:57 ait sshd[4107624]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.172.214
description:
2025-01-29 05:11:08 dovecot_plain authenticator failed for ([115.245.172.214]) [115.245.172.214]:55802: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.7.203.177
description:
2025-01-29 05:11:11 dovecot_plain authenticator failed for ([59.7.203.177]) [59.7.203.177]:45870: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-10.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.195.67.82
description:
Jan 29 05:10:46 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.195.67.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.88.64.163
description:
2025-01-29 05:10:46 dovecot_plain authenticator failed for ([222.88.64.163]) [222.88.64.163]:36466: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 05:10:57 ait sshd[4107624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.245.172.214
description:
Jan 29 05:11:06 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.245.172.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.7.203.177
description:
Jan 29 05:11:09 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.7.203.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 05:10:52 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.88.64.163
description:
Jan 29 05:10:44 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.88.64.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 05:11:21 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.192.94
description:
2025-01-29 05:11:36 dovecot_plain authenticator failed for 186-247-192-94.user.veloxzone.com.br ([179.236.122.153]) [186.247.192.94]:42157: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.220.97.188
description:
Jan 29 05:11:42 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.220.97.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.192.94
description:
Jan 29 05:11:34 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.192.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.16.161.35
description:
2025-01-29 05:11:28 dovecot_plain authenticator failed for ([105.16.161.35]) [105.16.161.35]:33878: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.220.97.188
description:
2025-01-29 05:11:44 dovecot_plain authenticator failed for c-98-220-97-188.hsd1.il.comcast.net [98.220.97.188]:51864: 535 Incorrect authentication data (set_id=abs19a00020y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 05:12:16 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.16.161.35
description:
Jan 29 05:11:26 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.16.161.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.184.58
description:
2025-01-29 05:12:30 dovecot_plain authenticator failed for ([120.237.184.58]) [120.237.184.58]:41699: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 05:12:41 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 05:12:49 ait sshd[4108125]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.181.81
description:
2025-01-29 05:12:55 dovecot_plain authenticator failed for ([85.130.181.81]) [85.130.181.81]:50325: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.184.58
description:
Jan 29 05:12:28 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 05:12:49 ait sshd[4108125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.181.81
description:
Jan 29 05:12:53 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.181.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.231.85.75
description:
Jan 29 05:14:33 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.231.85.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.231.85.75
description:
2025-01-29 05:14:35 dovecot_plain authenticator failed for ([41.231.85.75]) [41.231.85.75]:33250: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 29 05:14:48 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-29 05:14:50 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:58782: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.110.161.134
description:
Jan 29 05:14:56 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.110.161.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.110.161.134
description:
2025-01-29 05:14:58 dovecot_plain authenticator failed for ([36.110.161.134]) [36.110.161.134]:33231: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 134.22.116.38
description:
Jan 29 05:15:36 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 134.22.116.38 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-16.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.48.181
description:
2025-01-29 05:16:03 dovecot_plain authenticator failed for broadband-37-110-48-181.ip.moscow.rt.ru [37.110.48.181]:56010: 535 Incorrect authentication data (set_id=ads06a99959y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.24.215.70
description:
Jan 29 05:15:38 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.24.215.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.24.215.70
description:
2025-01-29 05:15:40 dovecot_plain authenticator failed for ([195.24.215.70]) [195.24.215.70]:52756: 535 Incorrect authentication data (set_id=ads20a00163y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-01-29 05:15:26 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:59920: 535 Incorrect authentication data (set_id=ads20a00163y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.47.48.178
description:
Jan 29 05:15:56 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.47.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.48.181
description:
Jan 29 05:16:01 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.48.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
description:
Jan 29 05:15:24 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.22.116.38
description:
2025-01-29 05:15:38 dovecot_plain authenticator failed for ([134.22.116.38]) [134.22.116.38]:59324: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.47.48.178
description:
2025-01-29 05:15:58 dovecot_plain authenticator failed for ([183.47.48.178]) [183.47.48.178]:34099: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.26.230
description:
Jan 29 05:16:12 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.26.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.26.230
description:
2025-01-29 05:16:14 dovecot_plain authenticator failed for 111-70-26-230.emome-ip.hinet.net [111.70.26.230]:46137: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
description:
2025-01-29 05:16:29 dovecot_plain authenticator failed for ([122.187.243.95]) [122.187.243.95]:36624: 535 Incorrect authentication data (set_id=ads06a99959y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
description:
Jan 29 05:16:27 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.45.167.29
description:
2025-01-29 05:18:00 dovecot_plain authenticator failed for net-2-45-167-29.cust.vodafonedsl.it [2.45.167.29]:55619: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.101
description:
Jan 29 05:18:10 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.101
description:
2025-01-29 05:18:12 dovecot_plain authenticator failed for 110-25-104-101.adsl.fetnet.net [110.25.104.101]:55310: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 05:17:51 ait sshd[4109857]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 05:17:51 ait sshd[4109857]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.45.167.29
description:
Jan 29 05:17:58 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.45.167.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.113.43.174
description:
Jan 29 05:19:01 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.113.43.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.113.43.174
description:
2025-01-29 05:19:03 dovecot_plain authenticator failed for (189-113-43-174.netturbo.com.br) [189.113.43.174]:33986: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 29 05:19:14 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-29 05:19:16 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:55320: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.117.173.143
description:
2025-01-29 05:19:46 dovecot_plain authenticator failed for ([183.237.61.147]) [113.117.173.143]:9652: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.71.38.42
description:
Jan 29 05:19:24 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.71.38.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.71.38.42
description:
2025-01-29 05:19:26 dovecot_plain authenticator failed for ([47.98.191.121]) [101.71.38.42]:19326: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.117.173.143
description:
Jan 29 05:19:44 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.117.173.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 29 05:21:00 ait sshd[4111199]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 29 05:21:00 ait sshd[4111199]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-21.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 05:23:53 ait sshd[4112118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.81.78
description:
Jan 29 05:23:26 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.81.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Jan 29 05:23:38 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-01-29 05:23:40 dovecot_plain authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:53054: 535 Incorrect authentication data (set_id=abs08a99987y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.81.78
description:
2025-01-29 05:23:28 dovecot_plain authenticator failed for ([61.51.81.78]) [61.51.81.78]:46544: 535 Incorrect authentication data (set_id=abs08a99987y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 29 05:23:53 ait sshd[4112118]: Invalid user universitypublishing from 116.122.157.193 port 58414


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 05:23:53 ait sshd[4112118]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
description:
2025-01-29 05:25:08 dovecot_plain authenticator failed for ([219.248.65.30]) [219.248.65.30]:42739: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.62.202
description:
2025-01-29 05:25:18 dovecot_plain authenticator failed for ([187.218.57.50]) [138.84.62.202]:24491: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-29 05:25:05 dovecot_plain authenticator failed for ([171.244.40.236]) [171.244.40.236]:52398: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.84.62.202
description:
Jan 29 05:25:16 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.84.62.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 29 05:24:32 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.205
description:
Jan 29 05:24:53 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.40.236
description:
Jan 29 05:25:03 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.40.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.248.65.30
description:
Jan 29 05:25:06 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.248.65.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 05:24:44 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.125.174.202
description:
2025-01-29 05:25:37 dovecot_plain authenticator failed for ([27.125.174.202]) [27.125.174.202]:41617: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 05:26:09 ait sshd[4113285]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
description:
2025-01-29 05:26:09 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:49706: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.62
description:
2025-01-29 05:26:19 dovecot_plain authenticator failed for (m121-202-153-62.smartone.com) [121.202.153.62]:61104: 535 Incorrect authentication data (set_id=ads20a00227y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.226.104
description:
2025-01-29 05:25:45 dovecot_plain authenticator failed for (104.226.75.138.unknown.m1.com.sg) [138.75.226.104]:59167: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
description:
2025-01-29 05:25:59 dovecot_plain authenticator failed for ([124.228.32.34]) [124.228.32.34]:39639: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
description:
Jan 29 05:26:19 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.185.15.126
description:
2025-01-29 05:25:32 dovecot_plain authenticator failed for ([211.185.15.126]) [211.185.15.126]:51612: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.62
description:
Jan 29 05:26:17 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.226.104
description:
Jan 29 05:25:43 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.226.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.8.174
description:
2025-01-29 05:25:26 dovecot_plain authenticator failed for ([60.166.8.174]) [60.166.8.174]:33537: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.217.220
description:
2025-01-29 05:25:26 dovecot_plain authenticator failed for ([183.234.217.220]) [183.234.217.220]:34990: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Jan 29 05:26:00 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.217.220
description:
Jan 29 05:25:24 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.217.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-01-29 05:26:02 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:40578: 535 Incorrect authentication data (set_id=ads20a00227y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
description:
Jan 29 05:26:07 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.185.15.126
description:
Jan 29 05:25:30 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.185.15.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.125.174.202
description:
Jan 29 05:25:35 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.125.174.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.18.246
description:
Jan 29 05:25:55 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.18.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
description:
Jan 29 05:25:57 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.18.246
description:
2025-01-29 05:25:57 dovecot_plain authenticator failed for 111-70-18-246.emome-ip.hinet.net [111.70.18.246]:56469: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 05:26:09 ait sshd[4113285]: Invalid user ferienhausurlaub.com 2a00 from 122.51.104.242 port 50296


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
description:
2025-01-29 05:26:21 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:61092: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.8.174
description:
Jan 29 05:25:24 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.8.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.173.61.81
description:
2025-01-29 05:27:06 dovecot_plain authenticator failed for ([112.173.61.81]) [112.173.61.81]:49746: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 05:26:25 ait sshd[4113324]: Failed password for invalid user ferienhausurlaub.com 2a00 from 122.51.104.242 port 54912 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 05:26:32 ait sshd[4113357]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.91.172.21
description:
Jan 29 05:26:51 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.91.172.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.91.172.21
description:
2025-01-29 05:26:53 dovecot_plain authenticator failed for ([219.91.172.21]) [219.91.172.21]:37238: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.29.176.41
description:
2025-01-29 05:27:12 dovecot_plain authenticator failed for 41.red-80-29-176.dynamicip.rima-tde.net [80.29.176.41]:43906: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 05:26:37 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 05:26:54 ait sshd[4113406]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.173.61.81
description:
Jan 29 05:27:04 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.173.61.81 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-27.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 05:26:32 ait sshd[4113357]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.29.176.41
description:
Jan 29 05:27:10 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.29.176.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.9
description:
2025-01-29 05:27:30 dovecot_plain authenticator failed for ([112.102.48.9]) [112.102.48.9]:60060: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 05:27:48 ait sshd[4113758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.9
description:
Jan 29 05:27:28 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 05:27:48 ait sshd[4113758]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.41.79
description:
47.128.41.79 - - [29/Jan/2025:05:28:12 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11049717 HTTP/1.1" 302 0 ait-open.net "http://ait-open.net/elearning/course/view.php?id=539" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.41.79


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
description:
Jan 29 05:28:55 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
description:
2025-01-29 05:28:57 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:33781: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.32.132.170
description:
Jan 29 05:29:06 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.32.132.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.32.132.170
description:
2025-01-29 05:29:08 dovecot_plain authenticator failed for ([117.32.132.170]) [117.32.132.170]:39513: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 05:29:11 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 05:29:58 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.162
description:
Jan 29 05:30:20 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.162
description:
2025-01-29 05:30:22 dovecot_plain authenticator failed for ([149.54.15.162]) [149.54.15.162]:41607: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Jan 29 05:30:37 ait sshd[4114960]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 05:30:45 ait sshd[4114978]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.122
description:
2025-01-29 05:30:48 dovecot_plain authenticator failed for ([103.79.175.122]) [103.79.175.122]:35522: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Jan 29 05:30:37 ait sshd[4114960]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.164.147.150
description:
2025-01-29 05:30:40 dovecot_plain authenticator failed for ([181.164.147.150]) [181.164.147.150]:18476: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.164.147.150
description:
Jan 29 05:30:38 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.164.147.150 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 05:30:45 ait sshd[4114978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.122
description:
Jan 29 05:30:46 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.218.142
description:
Jan 29 05:30:49 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.218.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
description:
2025-01-29 05:30:51 dovecot_plain authenticator failed for ([121.170.218.142]) [121.170.218.142]:43074: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-29 05:31:58 dovecot_plain authenticator failed for ([103.183.11.30]) [103.183.11.30]:39544: 535 Incorrect authentication data (set_id=sarpong-nsiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 05:32:12 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 29 05:31:36 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-29 05:31:38 dovecot_plain authenticator failed for (undefined.hostname.localhost) [182.76.87.90]:41276: 535 Incorrect authentication data (set_id=sarpong-nsiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.183.11.30
description:
Jan 29 05:31:56 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.183.11.30 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-33.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.22.46
description:
2025-01-29 05:32:41 dovecot_plain authenticator failed for (186-201-180-17.customer.tdatabrasil.net.br) [187.93.22.46]:53581: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.154.53.221
description:
Jan 29 05:32:50 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.154.53.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.154.53.221
description:
2025-01-29 05:32:52 dovecot_plain authenticator failed for ([101.230.251.217]) [180.154.53.221]:51430: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 05:32:35 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.22.46
description:
Jan 29 05:32:39 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.22.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 05:33:52 ait sshd[4115871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 05:33:52 ait sshd[4115871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-29 05:34:59 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:10607: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 29 05:35:04 ait sshd[4116589]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-01-29 05:35:19 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:41133: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.178.103.119
description:
2025-01-29 05:35:20 dovecot_plain authenticator failed for syn-076-178-103-119.res.spectrum.com [76.178.103.119]:41562: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 29 05:34:57 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 29 05:35:04 ait sshd[4116589]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Jan 29 05:35:17 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.178.103.119
description:
Jan 29 05:35:18 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.178.103.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.7.86.144
description:
Jan 29 05:35:33 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.7.86.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.208.186.206
description:
Jan 29 05:36:06 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.208.186.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.208.186.206
description:
2025-01-29 05:36:08 dovecot_plain authenticator failed for ([175.208.186.206]) [175.208.186.206]:51550: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jan 29 05:35:42 ait sshd[4116942]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.7.86.144
description:
2025-01-29 05:35:35 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.7.86.144]:39658: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 05:35:38 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.59.228.160
description:
Jan 29 05:35:38 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.59.228.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-01-29 05:35:40 dovecot_plain authenticator failed for (160.228-59-41.static-zone.ttcldata.net) [41.59.228.160]:46150: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 05:36:46 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.237.149.185
description:
Jan 29 05:38:46 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.237.149.185 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-38.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.73.223
description:
2025-01-29 05:38:36 dovecot_plain authenticator failed for ([27.188.73.223]) [27.188.73.223]:48824: 535 Incorrect authentication data (set_id=okyere@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.237.149.185
description:
2025-01-29 05:38:48 dovecot_plain authenticator failed for ([120.237.149.185]) [120.237.149.185]:64386: 535 Incorrect authentication data (set_id=okyere)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.73.223
description:
Jan 29 05:38:34 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.73.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 05:39:26 ait sshd[4117976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 29 05:39:51 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.37.192
description:
Jan 29 05:40:14 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.37.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 05:39:26 ait sshd[4117976]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.37.192
description:
Jan 29 05:40:28 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.37.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.97.90.143
description:
2025-01-29 05:42:33 dovecot_plain authenticator failed for ([180.97.90.143]) [180.97.90.143]:35554: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.186.68.153
description:
Jan 29 05:42:45 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.186.68.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.186.68.153
description:
2025-01-29 05:42:47 dovecot_plain authenticator failed for ([222.186.68.153]) [222.186.68.153]:50808: 535 Incorrect authentication data (set_id=obiri)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.97.90.143
description:
Jan 29 05:42:31 ait auth[4104896]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.97.90.143 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-44.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 05:44:44 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.247.196.106
description:
Jan 29 05:45:19 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.247.196.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.69.30.93
description:
2025-01-29 05:45:22 dovecot_plain authenticator failed for ([180.69.30.93]) [180.69.30.93]:55526: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.247.196.106
description:
2025-01-29 05:45:21 dovecot_plain authenticator failed for 186-247-196-106.user.veloxzone.com.br [186.247.196.106]:41741: 535 Incorrect authentication data (set_id=eng19b00228y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-29 05:45:11 dovecot_plain authenticator failed for ([116.50.246.69]) [58.69.17.18]:40050: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.95.250
description:
Jan 29 05:45:02 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.95.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.95.250
description:
2025-01-29 05:45:04 dovecot_plain authenticator failed for ([113.140.95.250]) [113.140.95.250]:46572: 535 Incorrect authentication data (set_id=eng19b00228y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 29 05:45:09 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.69.30.93
description:
Jan 29 05:45:20 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.69.30.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Jan 29 05:46:22 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.170.70.176
description:
Jan 29 05:46:22 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.170.70.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-01-29 05:46:24 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:43090: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.166.31.198
description:
Jan 29 05:46:33 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.166.31.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.166.31.198
description:
2025-01-29 05:46:35 dovecot_plain authenticator failed for ([60.166.31.198]) [60.166.31.198]:47976: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 05:47:21 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.20.66
description:
Jan 29 05:48:14 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.20.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.132.19
description:
Jan 29 05:47:53 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.42.132.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.42.132.19
description:
2025-01-29 05:47:55 dovecot_plain authenticator failed for ([111.42.132.19]) [111.42.132.19]:48086: 535 Incorrect authentication data (set_id=ads09a99921y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.218.7
description:
Jan 29 05:48:10 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.218.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.218.7
description:
2025-01-29 05:48:12 dovecot_plain authenticator failed for ([60.173.218.7]) [60.173.218.7]:48056: 535 Incorrect authentication data (set_id=ads09a99921y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-01-29 05:48:57 dovecot_plain authenticator failed for (mated) [84.238.92.245]:34071: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.1.34.242
description:
Jan 29 05:48:58 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.1.34.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-01-29 05:49:22 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2246: 535 Incorrect authentication data (set_id=ads89b99891y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
description:
Jan 29 05:48:55 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.1.34.242
description:
2025-01-29 05:49:00 dovecot_plain authenticator failed for dsl540122f2.fixip.t-online.hu (ajible) [84.1.34.242]:43420: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-01-29 05:49:08 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:58645: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 29 05:49:11 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.1.210
description:
2025-01-29 05:49:10 dovecot_plain authenticator failed for ([60.172.1.210]) [60.172.1.210]:37234: 535 Incorrect authentication data (set_id=ads89b99891y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.149.70.142
description:
Jan 29 05:48:42 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.149.70.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.70.142
description:
2025-01-29 05:48:44 dovecot_plain authenticator failed for ([218.149.70.142]) [218.149.70.142]:37512: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Jan 29 05:49:06 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.1.210
description:
Jan 29 05:49:08 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.1.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Jan 29 05:49:20 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.228.160
description:
2025-01-29 05:50:11 dovecot_plain authenticator failed for ([41.59.228.160]) [41.59.228.160]:43452: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 29 05:50:18 ait sshd[4121683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.66.124.148
description:
Jan 29 05:49:33 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.66.124.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
description:
2025-01-29 05:49:44 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:36984: 535 Incorrect authentication data (set_id=eng21a00038y6)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.35.217.44
description:
Jan 29 05:49:56 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.35.217.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.114.171
description:
Jan 29 05:49:35 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.114.171 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-49.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 29 05:50:18 ait sshd[4121683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.66.124.148
description:
2025-01-29 05:49:35 dovecot_plain authenticator failed for ([121.66.124.148]) [121.66.124.148]:55887: 535 Incorrect authentication data (set_id=eng21a00038y6@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.114.171
description:
2025-01-29 05:49:37 dovecot_plain authenticator failed for ([2.55.114.171]) [2.55.114.171]:45846: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
description:
Jan 29 05:49:42 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.91.200.139
description:
Jan 29 05:49:59 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.91.200.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.35.217.44
description:
2025-01-29 05:49:58 dovecot_plain authenticator failed for net-2-35-217-44.cust.vodafonedsl.it [2.35.217.44]:55623: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-29 05:50:01 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:41932: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-29 05:50:44 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:55141: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
description:
2025-01-29 05:51:12 dovecot_plain authenticator failed for ([62.201.228.210]) [62.201.228.210]:50098: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 05:50:30 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.30.9.253
description:
2025-01-29 05:50:30 dovecot_plain authenticator failed for (173-30-9-253.client.mchsi.com) [173.30.9.253]:57551: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-01-29 05:51:58 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:55320: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Jan 29 05:51:44 ait auth[4119726]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.139.102.153
description:
2025-01-29 05:51:46 dovecot_plain authenticator failed for ([144.139.102.153]) [144.139.102.153]:49120: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.51.186
description:
2025-01-29 05:51:36 dovecot_plain authenticator failed for ([186.247.238.25]) [200.149.51.186]:44763: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.93.182
description:
2025-01-29 05:51:41 dovecot_plain authenticator failed for ([112.31.93.182]) [112.31.93.182]:34718: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-01-29 05:51:46 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:38630: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Jan 29 05:51:27 ait sshd[4122083]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 29 05:51:27 ait sshd[4122083]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-01-29 05:52:38 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:39276: 535 Incorrect authentication data (set_id=eng19b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.23
description:
2025-01-29 05:52:50 dovecot_plain authenticator failed for ([121.202.152.23]) [121.202.152.23]:62261: 535 Incorrect authentication data (set_id=eng19b00213y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 05:53:39 ait sshd[4122940]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 05:53:39 ait sshd[4122940]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
description:
2025-01-29 05:54:22 dovecot_plain authenticator failed for ([122.187.230.154]) [122.187.230.154]:51431: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-29 05:54:33 dovecot_plain authenticator failed for ([218.106.120.18]) [58.49.113.138]:16303: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.185.85.162
description:
Jan 29 05:54:39 ait sshd[4123208]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.185.85.162  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 05:56:09 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:05-55.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 29 05:56:34 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.50.70.34
description:
2025-01-29 05:57:04 dovecot_plain authenticator failed for ([111.50.70.34]) [111.50.70.34]:39593: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.191.27
description:
Jan 29 05:57:15 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.191.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 29 05:56:42 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.50.70.34
description:
Jan 29 05:57:02 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.50.70.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.191.27
description:
2025-01-29 05:57:17 dovecot_plain authenticator failed for ([175.205.191.27]) [175.205.191.27]:38526: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-29 05:56:36 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:33236: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-29 05:56:44 dovecot_plain authenticator failed for ([85.19.195.12]) [85.19.195.12]:54930: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.185.85.162
description:
Jan 29 05:57:07 ait sshd[4124179]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.185.85.162  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.136
description:
Jan 29 05:57:31 ait sshd[4124269]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-01-29 05:57:37 dovecot_plain authenticator failed for ([211.53.58.1]) [211.169.212.206]:57805: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 29 05:58:00 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 29 05:58:02 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-29 05:58:04 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:33314: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.136
description:
Jan 29 05:57:31 ait sshd[4124269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.136


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Jan 29 05:57:35 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-29 05:58:02 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:28473: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.140.31.163
description:
Jan 29 05:58:18 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.140.31.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.140.31.163
description:
2025-01-29 05:58:20 dovecot_plain authenticator failed for ([103.140.31.163]) [103.140.31.163]:50903: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 05:58:46 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 05:59:05 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 05:59:19 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 29 06:00:11 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-29 06:00:13 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se (neleronci) [83.254.126.238]:49264: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 29 05:59:26 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-29 06:00:08 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (nucone) [2.139.88.148]:41908: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 29 06:00:36 ait sshd[4125593]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.185
description:
2025-01-29 06:00:44 dovecot_plain authenticator failed for ([220.180.171.185]) [220.180.171.185]:53739: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.207.117
description:
Jan 29 06:00:55 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.207.117 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-01.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.16.49.250
description:
2025-01-29 06:00:35 dovecot_plain authenticator failed for ([58.16.49.250]) [58.16.49.250]:40368: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 29 06:00:36 ait sshd[4125593]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.171.185
description:
Jan 29 06:00:42 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.171.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.86.163.194
description:
Jan 29 06:00:44 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.86.163.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.207.117
description:
2025-01-29 06:00:57 dovecot_plain authenticator failed for bzq-85-130-207-117.static-ip.bezeqint.net [85.130.207.117]:52826: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.16.49.250
description:
Jan 29 06:00:33 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.16.49.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.86.163.194
description:
2025-01-29 06:00:46 dovecot_plain authenticator failed for ppp-210-86-163-194.revip.asianet.co.th [210.86.163.194]:56785: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.179
description:
2025-01-29 06:01:50 dovecot_plain authenticator failed for (static.ill.117.250.107.179.bsnl.co.in) [117.250.107.179]:38322: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
description:
2025-01-29 06:02:04 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:59629: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 06:02:11 ait sshd[4126148]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.179
description:
Jan 29 06:01:48 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
description:
Jan 29 06:02:02 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 06:02:08 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 06:02:11 ait sshd[4126148]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 06:02:39 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.61.7.100
description:
Jan 29 06:02:51 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.61.7.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.7.100
description:
2025-01-29 06:02:53 dovecot_plain authenticator failed for 100.7.61.94.rev.vodafone.pt [94.61.7.100]:50332: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Jan 29 06:03:10 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.202.250.46
description:
Jan 29 06:03:14 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.202.250.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-29 06:03:12 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:43343: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.202.250.46
description:
2025-01-29 06:03:16 dovecot_plain authenticator failed for ([200.202.250.46]) [200.202.250.46]:35797: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 122.224.68.162
description:
2025-01-29 06:03:23 H=(mail.bsoft.cloud) [122.224.68.162]:31881 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 CV=no F=<wdnkbvykhh@bsoft.cloud> rejected RCPT <E1pvJDf-0007Ln-1b@ait.aitvarsity.net>: Unrouteable address


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 06:03:35 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.140.32.93
description:
Jan 29 06:03:40 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.140.32.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.140.32.93
description:
2025-01-29 06:03:42 dovecot_plain authenticator failed for ([158.140.32.93]) [158.140.32.93]:38775: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.36.222
description:
47.128.36.222 - - [29/Jan/2025:06:04:51 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=4687375 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C30&filter_course-language=198%2C99%2C183&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.36.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 29 06:05:03 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-29 06:05:05 dovecot_plain authenticator failed for (static-TB-132-226.kbcnet.rs) [91.234.132.226]:45567: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.238.92.245
description:
Jan 29 06:05:41 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.238.92.245 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 29 06:05:48 ait sshd[4127590]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-29 06:05:56 dovecot_plain authenticator failed for ([121.202.155.10]) [121.202.155.10]:29617: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.75.172.163
description:
Jan 29 06:05:59 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.75.172.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Jan 29 06:06:10 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.43.231.186
description:
2025-01-29 06:06:09 dovecot_plain authenticator failed for host-88-43-231-186.business.telecomitalia.it ([88.43.231.188]) [88.43.231.186]:47840: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
description:
Jan 29 06:05:58 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-29 06:06:11 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:45852: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-29 06:06:12 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:27502: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 29 06:05:48 ait sshd[4127590]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 29 06:05:54 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-01-29 06:05:57 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:38830: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
description:
2025-01-29 06:06:00 dovecot_plain authenticator failed for ([125.72.92.174]) [125.72.92.174]:59175: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Jan 29 06:06:09 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.171.195.70
description:
Jan 29 06:06:23 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.171.195.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.238.92.245
description:
2025-01-29 06:05:43 dovecot_plain authenticator failed for (84-238-92-245.ptr.bnaa.dk) [84.238.92.245]:38964: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Jan 29 06:05:55 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.75.172.163
description:
2025-01-29 06:06:01 dovecot_plain authenticator failed for ([220.75.172.163]) [220.75.172.163]:60172: 535 Incorrect authentication data (set_id=office@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.43.231.186
description:
Jan 29 06:06:07 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.43.231.186 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-07.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.171.195.70
description:
2025-01-29 06:06:25 dovecot_plain authenticator failed for ([216.171.195.70]) [216.171.195.70]:56562: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.31.8.202
description:
Jan 29 06:06:29 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.31.8.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.96.160.35
description:
Jan 29 06:06:40 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.96.160.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.157
description:
Jan 29 06:06:48 ait sshd[4127921]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.157
description:
Jan 29 06:06:48 ait sshd[4127921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.157  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.31.8.202
description:
2025-01-29 06:06:31 dovecot_plain authenticator failed for (113-11-34-221-smile.com.bd) [114.31.8.202]:51206: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.96.160.35
description:
2025-01-29 06:06:42 dovecot_plain authenticator failed for ([211.96.160.35]) [211.96.160.35]:44527: 535 Incorrect authentication data (set_id=postmaster)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 37.97.228.222
domain: mail.ait-open.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:nii-quaye||WPU:nii-quaye||RSV:6.65||T:APACHE||MV:06-06.37.97.228.222


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.157
description:
Jan 29 06:08:13 ait sshd[4128403]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.157  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.251.108.124
description:
Jan 29 06:08:21 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.251.108.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.251.108.124
description:
2025-01-29 06:08:23 dovecot_plain authenticator failed for ([45.251.108.124]) [45.251.108.124]:51692: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.157
description:
Jan 29 06:08:13 ait sshd[4128403]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 29 06:08:35 ait sshd[4128541]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 29 06:08:35 ait sshd[4128541]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.151.148
description:
2025-01-29 06:09:11 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.151.148]:37127: 535 Incorrect authentication data (set_id=ads20b00288y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.151.148
description:
Jan 29 06:09:09 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.151.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.243.7.50
description:
Jan 29 06:08:41 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.243.7.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.243.7.50
description:
2025-01-29 06:08:43 dovecot_plain authenticator failed for ([203.243.7.50]) [203.243.7.50]:49536: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.90.253
description:
Jan 29 06:08:52 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.90.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.47.211
description:
Jan 29 06:08:53 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.47.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.90.253
description:
2025-01-29 06:08:54 dovecot_plain authenticator failed for ([45.181.90.253]) [45.181.90.253]:46078: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.47.211
description:
2025-01-29 06:08:55 dovecot_plain authenticator failed for ([188.226.47.211]) [188.226.47.211]:55448: 535 Incorrect authentication data (set_id=ads20b00288y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
description:
Jan 29 06:09:17 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
description:
2025-01-29 06:09:19 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:34388: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.31.11
description:
47.128.31.11 - - [29/Jan/2025:06:09:25 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=5009511 HTTP/2.0" 302 0 udesk.ait-ext.com "https://udesk.ait-ext.com/_profiler/c81320?panel=twig" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.31.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 06:09:43 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 29 06:10:08 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-29 06:10:10 dovecot_plain authenticator failed for mail.schindler-statik.at (morculack) [80.120.186.246]:52614: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
description:
Jan 29 06:11:00 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
description:
2025-01-29 06:11:02 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:60164: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Jan 29 06:11:09 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-29 06:11:11 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:59557: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.220.33
description:
2025-01-29 06:11:33 dovecot_plain authenticator failed for ([106.51.120.94]) [106.51.220.33]:27772: 535 Incorrect authentication data (set_id=abs2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
description:
Jan 29 06:11:43 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
description:
2025-01-29 06:11:45 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:34890: 535 Incorrect authentication data (set_id=abs2)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.1.50
description:
Jan 29 06:12:24 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.1.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.220.33
description:
Jan 29 06:11:31 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.220.33 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-12.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.18.3
description:
2025-01-29 06:13:23 dovecot_plain authenticator failed for ([175.198.18.3]) [175.198.18.3]:56066: 535 Incorrect authentication data (set_id=ads19b00251y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.1.50
description:
2025-01-29 06:12:26 dovecot_plain authenticator failed for ([113.140.1.50]) [113.140.1.50]:52259: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 29 06:12:47 ait sshd[4130488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.87.152.161
description:
Jan 29 06:13:06 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.87.152.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.87.152.161
description:
2025-01-29 06:13:08 dovecot_plain authenticator failed for ([194.87.152.161]) [194.87.152.161]:60096: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.0.8.92
description:
2025-01-29 06:12:40 dovecot_plain authenticator failed for (apn-31-0-8-92.static.gprs.plus.pl) [31.0.8.92]:55145: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.45.101.159
description:
Jan 29 06:13:18 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.45.101.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.45.101.159
description:
2025-01-29 06:13:20 dovecot_plain authenticator failed for ([118.45.101.159]) [118.45.101.159]:57108: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.198.18.3
description:
Jan 29 06:13:21 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.198.18.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.0.8.92
description:
Jan 29 06:12:38 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.0.8.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 29 06:12:47 ait sshd[4130488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.34.254
description:
Jan 29 06:13:26 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.34.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.34.254
description:
2025-01-29 06:13:28 dovecot_plain authenticator failed for broadband-5-228-34-254.ip.moscow.rt.ru [5.228.34.254]:49952: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 29 06:15:07 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-29 06:15:09 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:58465: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 06:15:09 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.93.167.144
description:
Jan 29 06:15:19 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.93.167.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.93.167.144
description:
2025-01-29 06:15:21 dovecot_plain authenticator failed for ([220.93.167.144]) [220.93.167.144]:53522: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 29 06:15:22 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-29 06:15:24 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:57716: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.107.179
description:
Jan 29 06:15:32 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.107.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.71.37.202
description:
Jan 29 06:16:06 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.71.37.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.71.37.202
description:
2025-01-29 06:16:08 dovecot_plain authenticator failed for ([47.98.191.121]) [101.71.37.202]:47113: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.179
description:
2025-01-29 06:15:34 dovecot_login authenticator failed for (static.ill.117.250.107.179.bsnl.co.in) [117.250.107.179]:48697: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.221.65.24
description:
Jan 29 06:15:55 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.221.65.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Jan 29 06:16:12 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.169.207.93
description:
Jan 29 06:16:05 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.169.207.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
description:
2025-01-29 06:16:07 dovecot_plain authenticator failed for ([122.169.207.93]) [122.169.207.93]:4526: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-01-29 06:16:14 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:53072: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.226.83
description:
2025-01-29 06:15:55 dovecot_plain authenticator failed for ([62.192.226.83]) [62.192.226.83]:33380: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.65.24
description:
2025-01-29 06:15:57 dovecot_plain authenticator failed for ([102.221.65.24]) [102.221.65.24]:33457: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.101.16.250
description:
Jan 29 06:16:24 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.101.16.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.101.16.250
description:
2025-01-29 06:16:26 dovecot_plain authenticator failed for ([185.134.179.106]) [185.101.16.250]:52919: 535 Incorrect authentication data (set_id=stquarshie)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-18.194.163.182.227


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-19.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 29 06:19:00 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 111.23.122.227
domain: 136.243.145.84:80
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:06-19.111.23.122.227||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.190.91.98
description:
Jan 29 06:19:19 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.190.91.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.69.142.186
description:
Jan 29 06:19:14 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.69.142.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.69.142.186
description:
2025-01-29 06:19:16 dovecot_plain authenticator failed for 61-69-142-186.tpgi.com.au [61.69.142.186]:33186: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.98
description:
2025-01-29 06:19:21 dovecot_plain authenticator failed for ([103.190.91.98]) [103.190.91.98]:45460: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-29 06:19:02 dovecot_plain authenticator failed for ([60.8.120.74]) [60.8.50.150]:55710: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.12.254.47
description:
Jan 29 06:19:35 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.12.254.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.12.254.47
description:
2025-01-29 06:19:37 dovecot_plain authenticator failed for ([106.12.254.47]) [106.12.254.47]:62444: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Jan 29 06:19:51 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-01-29 06:19:53 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:33744: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Jan 29 06:19:30 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-01-29 06:19:32 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:57808: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-29 06:22:23 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (chogly) [87.103.126.54]:26923: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 29 06:21:33 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-29 06:21:35 dovecot_login authenticator failed for ([93.182.160.222]) [93.182.160.222]:40824: 535 Incorrect authentication data (set_id=freeman@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.35.155.182
description:
Jan 29 06:21:41 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.35.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.35.155.182
description:
2025-01-29 06:21:43 dovecot_login authenticator failed for ([178.35.155.182]) [178.35.155.182]:46458: 535 Incorrect authentication data (set_id=freeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 29 06:22:21 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 29 06:22:54 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-29 06:22:56 dovecot_plain authenticator failed for ([200.141.225.73]) [200.149.54.14]:50846: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.243.95
description:
Jan 29 06:23:05 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.243.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.243.95
description:
2025-01-29 06:23:07 dovecot_plain authenticator failed for ([122.187.243.95]) [122.187.243.95]:44194: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.38.209.189
description:
Jan 29 06:23:23 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.38.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.231.75.69
description:
Jan 29 06:24:00 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.231.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.75.69
description:
2025-01-29 06:24:02 dovecot_plain authenticator failed for ([49.231.75.69]) [49.231.75.69]:54856: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 29 06:23:25 ait sshd[4134573]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 29 06:23:25 ait sshd[4134573]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 29 06:24:12 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
description:
Jan 29 06:23:42 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
description:
2025-01-29 06:23:44 dovecot_login authenticator failed for ([185.148.218.235]) [185.148.218.235]:54900: 535 Incorrect authentication data (set_id=osngsua)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-24.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.22.68.213
description:
2025-01-29 06:24:14 dovecot_plain authenticator failed for ([59.22.68.213]) [59.22.68.213]:59190: 535 Incorrect authentication data (set_id=ads88a00088y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-29 06:24:14 dovecot_plain authenticator failed for ([82.84.122.203]) [82.84.122.203]:64663: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.38.209.189
description:
2025-01-29 06:23:25 dovecot_login authenticator failed for p381190-obmd01.tokyo.ocn.ne.jp [60.38.209.189]:58163: 535 Incorrect authentication data (set_id=osngsua@ait.edu.gh)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.33.87
description:
47.128.33.87 - - [29/Jan/2025:06:23:27 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23237644 HTTP/2.0" 302 0 gou.university "https://gou.university/cgi-sys/suspendedpage.cgi?filter_course-category=61%2C106%2C205%2C30&filter_course-language=79%2C121%2C183&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.33.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Jan 29 06:23:32 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-01-29 06:23:34 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:37972: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.22.68.213
description:
Jan 29 06:24:12 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.22.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-29 06:24:32 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:58700: 535 Incorrect authentication data (set_id=ads88a00088y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.68.12.96
description:
[2025-01-29 06:24:49 +0100] info [whostmgrd] 77.68.12.96 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 29 06:24:30 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.146
description:
2025-01-29 06:24:26 dovecot_plain authenticator failed for syn-035-130-111-146.biz.spectrum.com [35.130.111.146]:41780: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-29 06:25:03 dovecot_plain authenticator failed for ([170.250.152.88]) [170.250.152.88]:34012: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.185.68.142
description:
Jan 29 06:25:12 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.185.68.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.130.111.146
description:
Jan 29 06:24:24 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.130.111.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 29 06:25:01 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.185.68.142
description:
2025-01-29 06:25:14 dovecot_plain authenticator failed for ([61.185.68.142]) [61.185.68.142]:47695: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.68.12.96
description:
Jan 29 06:24:50 ait sshd[4134897]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.68.12.96  user=ait002


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.68.12.96
description:
Jan 29 06:24:50 ait sshd[4134897]: pam_imunify(sshd:auth): [IM360_RBL] The IP 77.68.12.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
description:
Jan 29 06:25:49 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.18.106.15
description:
Jan 29 06:26:21 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.18.106.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.18.106.15
description:
2025-01-29 06:26:23 dovecot_plain authenticator failed for pool-108-18-106-15.washdc.fios.verizon.net [108.18.106.15]:38388: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.78.70
description:
Jan 29 06:25:27 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.78.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-29 06:25:40 dovecot_plain authenticator failed for ([186.232.193.44]) [186.232.193.44]:54938: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
description:
2025-01-29 06:25:51 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:58909: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
description:
2025-01-29 06:26:04 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:26456: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.78.70
description:
2025-01-29 06:25:29 dovecot_plain authenticator failed for 80-15-78-70.ftth.fr.orangecustomers.net (dionowpoty) [80.15.78.70]:42764: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.20.159.141
description:
Jan 29 06:25:35 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.20.159.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 29 06:25:38 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.87.246
description:
Jan 29 06:25:47 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.87.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.87.246
description:
2025-01-29 06:25:49 dovecot_plain authenticator failed for ([1.28.87.246]) [1.28.87.246]:38010: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.14.157.15
description:
2025-01-29 06:25:56 dovecot_plain authenticator failed for ([218.14.157.15]) [218.14.157.15]:57379: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.20.159.141
description:
2025-01-29 06:25:37 dovecot_plain authenticator failed for ([115.20.159.141]) [115.20.159.141]:41855: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.14.157.15
description:
Jan 29 06:25:54 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.14.157.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
description:
Jan 29 06:26:02 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.158.42
description:
Jan 29 06:26:33 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.158.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.158.42
description:
2025-01-29 06:26:35 dovecot_plain authenticator failed for (186-201-3-45.customer.tdatabrasil.net.br) [186.200.158.42]:48961: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.34.241
description:
47.128.34.241 - - [29/Jan/2025:06:26:50 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=17153501 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/3/?duration=short%2Cmedium&filter_course-language=99&filtering=1&instructor=2&level=intermediate%2Cbeginner" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.34.241


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.70.129.101
description:
2025-01-29 06:28:10 dovecot_plain authenticator failed for syn-097-070-129-101.res.spectrum.com [97.70.129.101]:37812: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 06:27:39 ait sshd[4136194]: Invalid user ferienhausurlaub.com 2a00 from 122.51.104.242 port 60738


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 06:27:39 ait sshd[4136194]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.120.163.110
description:
Jan 29 06:27:49 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.120.163.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.70.129.101
description:
Jan 29 06:28:08 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.70.129.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 06:27:39 ait sshd[4136194]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-29 06:27:51 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:33862: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.102.141.124
description:
Jan 29 06:28:44 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.102.141.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.102.141.124
description:
2025-01-29 06:28:46 dovecot_plain authenticator failed for ([75.102.141.124]) [75.102.141.124]:50708: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.108.88.121
description:
2025-01-29 06:28:56 dovecot_plain authenticator failed for ([113.108.88.121]) [113.108.88.121]:45404: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.108.88.121
description:
Jan 29 06:28:54 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.108.88.121 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 06:29:32 ait sshd[4136750]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.70.28
description:
2025-01-29 06:29:48 dovecot_plain authenticator failed for ([110.34.70.28]) [110.34.70.28]:35967: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.182.32.16
description:
2025-01-29 06:29:58 dovecot_plain authenticator failed for ([118.182.32.16]) [118.182.32.16]:60026: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-29.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.182.32.16
description:
Jan 29 06:29:56 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.182.32.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-29 06:30:00 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:39072: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 06:29:32 ait sshd[4136750]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.105.113
description:
Jan 29 06:29:44 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.105.113 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.111.53
description:
47.128.111.53 - - [29/Jan/2025:06:29:44 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=11065533 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/12/?filter_course-category=125&filter_course-language=79&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.111.53


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.105.113
description:
2025-01-29 06:29:46 dovecot_plain authenticator failed for (177-174-105-113.user.vivozap.com.br) [177.174.105.113]:49122: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.70.28
description:
Jan 29 06:29:46 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.70.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 29 06:29:58 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 29 06:30:29 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-29 06:30:31 dovecot_plain authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:54050: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.44.67.28
description:
Jan 29 06:30:40 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.44.67.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.44.67.28
description:
2025-01-29 06:30:42 dovecot_plain authenticator failed for (platuan) [185.44.67.28]:52844: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-01-29 06:31:51 dovecot_login authenticator failed for ([196.200.227.194]) [196.200.227.194]:53290: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Jan 29 06:31:58 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
description:
Jan 29 06:31:58 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Jan 29 06:31:49 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 06:32:03 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 29 06:31:45 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-29 06:31:47 dovecot_plain authenticator failed for ([109.195.69.156]) [109.195.69.156]:57545: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-01-29 06:32:00 dovecot_login authenticator failed for ([65.76.31.73]) [65.76.31.73]:52332: 535 Incorrect authentication data (set_id=dhdvn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
description:
2025-01-29 06:32:00 dovecot_plain authenticator failed for ([109.233.21.109]) [109.233.21.109]:48210: 535 Incorrect authentication data (set_id=tsikpo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.59.106
description:
Jan 29 06:33:01 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.59.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.88.64.163
description:
2025-01-29 06:33:45 dovecot_plain authenticator failed for ([222.88.64.163]) [222.88.64.163]:44885: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.57.106
description:
2025-01-29 06:33:58 dovecot_plain authenticator failed for ([65.76.57.106]) [65.76.57.106]:60578: 535 Incorrect authentication data (set_id=nkbosomefi)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 06:34:14 ait sshd[4138667]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 06:33:32 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.244.39
description:
2025-01-29 06:33:52 dovecot_plain authenticator failed for ([103.69.244.39]) [103.69.244.39]:59314: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.57.106
description:
Jan 29 06:33:56 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.57.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.37.177.219
description:
2025-01-29 06:34:07 dovecot_plain authenticator failed for ([61.177.36.109]) [153.37.177.219]:61960: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 06:34:14 ait sshd[4138667]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 206.72.242.234
description:
Jan 29 06:34:18 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 206.72.242.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.88.64.163
description:
Jan 29 06:33:43 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.88.64.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.244.39
description:
Jan 29 06:33:50 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 153.37.177.219
description:
Jan 29 06:34:05 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 153.37.177.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.72.242.234
description:
2025-01-29 06:34:20 dovecot_plain authenticator failed for ([206.72.242.234]) [206.72.242.234]:36702: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-29 06:35:22 dovecot_plain authenticator failed for (facrition) [102.53.15.18]:33790: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.37.116
description:
2025-01-29 06:34:43 dovecot_plain authenticator failed for ([211.193.37.116]) [211.193.37.116]:33738: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 29 06:35:20 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 06:34:27 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.193.37.116
description:
Jan 29 06:34:41 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.193.37.116 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.122.104
description:
47.128.122.104 - - [29/Jan/2025:06:35:30 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23737795 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/course-tag/personal/?duration=extraLong&filtering=1" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.122.104


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-35.194.163.182.227


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 06:35:49 ait sshd[4139327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 29 06:35:25 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-29 06:35:27 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (perdeze) [91.56.31.167]:61815: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 06:35:49 ait sshd[4139327]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.204.109
description:
Jan 29 06:36:33 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.204.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-29 06:36:45 dovecot_plain authenticator failed for ([93.182.160.222]) [93.182.160.222]:36256: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
description:
2025-01-29 06:37:16 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:60778: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
description:
2025-01-29 06:36:35 dovecot_plain authenticator failed for (ucicinemas.static.gvt.net.br) [186.215.204.109]:60291: 535 Incorrect authentication data (set_id=postmaster@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.224.62.206
description:
Jan 29 06:37:02 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.224.62.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 29 06:36:43 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
description:
2025-01-29 06:37:04 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:38515: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
description:
Jan 29 06:37:14 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 06:38:07 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.98.134
description:
Jan 29 06:38:01 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.98.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.102
description:
2025-01-29 06:38:16 dovecot_plain authenticator failed for (nsg-corporate-102.234.187.122.airtel.in) [122.187.234.102]:47068: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.234.102
description:
Jan 29 06:38:14 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.234.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.178
description:
Jan 29 06:38:15 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.178
description:
2025-01-29 06:38:17 dovecot_plain authenticator failed for ([197.250.7.67]) [41.220.129.178]:46352: 535 Incorrect authentication data (set_id=ads21a00112y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.98.134
description:
2025-01-29 06:38:03 dovecot_plain authenticator failed for ([138.75.98.134]) [138.75.98.134]:32892: 535 Incorrect authentication data (set_id=ads21a00112y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 29 06:38:47 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.189.151
description:
Jan 29 06:39:04 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.189.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 06:38:56 ait sshd[4140284]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 06:38:56 ait sshd[4140284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.103.200
description:
2025-01-29 06:39:08 dovecot_plain authenticator failed for 110-25-103-200.adsl.fetnet.net [110.25.103.200]:38500: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.214.65.245
description:
2025-01-29 06:39:09 dovecot_plain authenticator failed for ([123.214.65.245]) [123.214.65.245]:48710: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 77.83.1.205
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:gvu_admin||WPU:gvu_admin||RSV:6.65||T:APACHE||MV:06-38.77.83.1.205


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.124.218
description:
2025-01-29 06:38:54 dovecot_plain authenticator failed for ([196.189.124.218]) [196.189.124.218]:52260: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.103.200
description:
Jan 29 06:39:06 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.103.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.97.138
description:
2025-01-29 06:38:34 dovecot_plain authenticator failed for ([1.180.97.138]) [1.180.97.138]:38521: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-29 06:38:49 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (eltring) [87.103.126.54]:20386: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
description:
Jan 29 06:38:52 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.253.18.251
description:
Jan 29 06:38:59 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.253.18.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.253.18.251
description:
2025-01-29 06:39:01 dovecot_plain authenticator failed for ([120.253.18.251]) [120.253.18.251]:58675: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.214.65.245
description:
Jan 29 06:39:07 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.214.65.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.97.138
description:
Jan 29 06:38:32 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.97.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.179
description:
Jan 29 06:38:42 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.179
description:
2025-01-29 06:38:44 dovecot_plain authenticator failed for (m121-202-153-179.smartone.com) [121.202.153.179]:47698: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 06:41:05 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.15.121
description:
Jan 29 06:41:06 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.15.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.146.210
description:
Jan 29 06:41:15 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.146.210 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-41.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 29 06:40:43 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.134.14.249
description:
Jan 29 06:41:33 ait sshd[4141732]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.134.14.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.112.222.137
description:
Jan 29 06:41:56 ait sshd[4141798]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.112.222.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.15.121
description:
Jan 29 06:41:22 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.15.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 06:42:01 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.134.14.249
description:
Jan 29 06:41:33 ait sshd[4141732]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.134.14.249


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 06:41:42 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.112.222.137
description:
Jan 29 06:41:56 ait sshd[4141798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.112.222.137


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.134.14.249
description:
Jan 29 06:43:02 ait sshd[4142042]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.134.14.249


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.227.152.171
description:
Jan 29 06:43:17 ait sshd[4142057]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.227.152.171 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.227.152.171
description:
Jan 29 06:43:17 ait sshd[4142057]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.227.152.171


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.66
description:
Jan 29 06:42:31 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.66
description:
2025-01-29 06:42:33 dovecot_plain authenticator failed for ([196.28.226.66]) [196.28.226.66]:48422: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.134.14.249
description:
Jan 29 06:43:02 ait sshd[4142042]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.134.14.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.34
description:
Jan 29 06:42:42 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
description:
2025-01-29 06:42:44 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:47196: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.36.81.223
description:
Jan 29 06:43:38 ait sshd[4142268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.36.81.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.35
description:
Jan 29 06:43:58 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.35
description:
2025-01-29 06:44:00 dovecot_plain authenticator failed for ([114.242.61.19]) [114.242.61.35]:35180: 535 Incorrect authentication data (set_id=ads11a00011y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
description:
2025-01-29 06:44:11 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:48212: 535 Incorrect authentication data (set_id=ads11a00011y)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.227.152.171
description:
Jan 29 06:43:20 ait sshd[4142057]: Disconnected from invalid user ftpuser 121.227.152.171 port 40416 [preauth]


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 190.112.222.137
description:
Jan 29 06:43:31 ait sshd[4142207]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=190.112.222.137


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.36.81.223
description:
Jan 29 06:43:38 ait sshd[4142268]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.36.81.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.112.222.137
description:
Jan 29 06:43:31 ait sshd[4142207]: pam_imunify(sshd:auth): [IM360_RBL] The IP 190.112.222.137 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 190.112.222.137
description:
Jan 29 06:43:33 ait sshd[4142207]: Failed password for invalid user dev from 190.112.222.137 port 40388 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
description:
Jan 29 06:44:09 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.100.104
description:
Jan 29 06:45:02 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.100.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.211.16.20
description:
Jan 29 06:45:16 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.211.16.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
description:
Jan 29 06:45:16 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-01-29 06:45:18 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:53058: 535 Incorrect authentication data (set_id=eng17b00236y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.227.152.171
description:
Jan 29 06:44:41 ait sshd[4142522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.227.152.171


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.134.14.249
description:
Jan 29 06:44:27 ait sshd[4142420]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.134.14.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.16.20
description:
2025-01-29 06:45:18 dovecot_plain authenticator failed for 217-211-16-20-no600.tbcn.telia.com [217.211.16.20]:46580: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 06:45:09 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.134.14.249
description:
Jan 29 06:44:27 ait sshd[4142420]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.134.14.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.100.104
description:
2025-01-29 06:45:04 dovecot_plain authenticator failed for (2-55-100-104.orange.net.il) [2.55.100.104]:42906: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.109.164.46
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:06-44.65.109.164.46


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.227.152.171
description:
Jan 29 06:44:41 ait sshd[4142522]: pam_imunify(sshd:auth): [IM360_RBL] The IP 121.227.152.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.41.81.24
description:
Jan 29 06:45:27 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.41.81.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.41.81.24
description:
2025-01-29 06:45:29 dovecot_plain authenticator failed for ([31.41.81.24]) [31.41.81.24]:49246: 535 Incorrect authentication data (set_id=eng17b00236y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-01-29 06:46:17 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:47392: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 06:45:21 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Jan 29 06:46:15 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.36.81.223
description:
Jan 29 06:46:54 ait sshd[4143493]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.36.81.223 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.36.81.223
description:
Jan 29 06:46:54 ait sshd[4143493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.36.81.223


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-46.194.163.182.227


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 14.139.183.115
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:06-46.14.139.183.115


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 29 06:47:20 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 77.68.12.96
description:
Jan 29 06:47:21 ait sshd[4143531]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=77.68.12.96


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.68.12.96
description:
[2025-01-29 06:47:20 +0100] info [whostmgrd] 77.68.12.96 - (https "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-29 06:47:22 dovecot_plain authenticator failed for (psistrides) [46.30.161.197]:37033: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Jan 29 06:48:57 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-01-29 06:48:59 dovecot_plain authenticator failed for ([1.30.20.98]) [1.30.20.98]:34090: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.36.81.223
description:
Jan 29 06:49:06 ait sshd[4144041]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.36.81.223 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 185.36.81.223
description:
Jan 29 06:49:08 ait sshd[4144041]: Failed password for invalid user test1 from 185.36.81.223 port 50308 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.18.139.82
description:
2025-01-29 06:48:42 dovecot_plain authenticator failed for ([60.18.139.82]) [60.18.139.82]:43390: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.36.81.223
description:
Jan 29 06:49:06 ait sshd[4144041]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.36.81.223


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.18.139.82
description:
Jan 29 06:48:40 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.18.139.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.76
description:
Jan 29 06:50:04 ait sshd[4144543]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.76
description:
Jan 29 06:50:04 ait sshd[4144543]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.76


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.244.213.234
description:
2025-01-29 06:50:18 dovecot_plain authenticator failed for ([115.244.213.234]) [115.244.213.234]:49374: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
description:
2025-01-29 06:50:02 dovecot_plain authenticator failed for ool-457bdb52.dyn.optonline.net (thwomenim) [69.123.219.82]:47571: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
description:
Jan 29 06:50:00 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 29 06:50:03 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
description:
2025-01-29 06:50:05 dovecot_plain authenticator failed for (riscoidie) [102.53.15.56]:36689: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.142.135
description:
Jan 29 06:50:07 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.142.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.142.135
description:
2025-01-29 06:50:09 dovecot_plain authenticator failed for ([171.244.142.135]) [171.244.142.135]:9477: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.244.213.234
description:
Jan 29 06:50:16 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.244.213.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 29 06:50:26 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-29 06:50:28 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:51058: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.168.78
description:
Jan 29 06:50:37 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.168.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.168.78
description:
2025-01-29 06:50:39 dovecot_plain authenticator failed for ([45.168.168.78]) [45.168.168.78]:55735: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 06:50:59 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 06:51:10 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Jan 29 06:51:51 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.124.152
description:
Jan 29 06:52:12 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.124.152 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.124.152
description:
2025-01-29 06:52:14 dovecot_plain authenticator failed for ([94.207.124.152]) [94.207.124.152]:55764: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Jan 29 06:52:19 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.230.236.86
description:
Jan 29 06:52:02 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.230.236.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.230.236.86
description:
2025-01-29 06:52:04 dovecot_plain authenticator failed for ([58.230.236.86]) [58.230.236.86]:33740: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.107.189
description:
Jan 29 06:51:41 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.107.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.107.189
description:
2025-01-29 06:51:43 dovecot_plain authenticator failed for (biophormula.static.gvt.net.br) [186.215.107.189]:54253: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 06:51:46 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-01-29 06:51:53 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:43483: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 29 06:52:41 ait sshd[4145730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-52.194.163.182.227


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-01-29 06:52:21 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:55272: 535 Incorrect authentication data (set_id=ads20a00071y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 29 06:52:41 ait sshd[4145730]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.198.37.128
description:
2025-01-29 06:53:13 dovecot_plain authenticator failed for ([116.198.37.128]) [116.198.37.128]:58604: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.198.37.128
description:
Jan 29 06:53:11 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.198.37.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 06:53:10 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
description:
Jan 29 06:53:23 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
description:
2025-01-29 06:53:25 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:36026: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 29 06:53:30 ait sshd[4145921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.214.10.178
description:
Jan 29 06:53:42 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.214.10.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
description:
2025-01-29 06:53:44 dovecot_plain authenticator failed for ([41.214.10.178]) [41.214.10.178]:50838: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.180.84
description:
Jan 29 06:53:57 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.180.84 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 29 06:53:30 ait sshd[4145921]: Invalid user ferienhausurlaub.com 2a00 from 122.51.104.242 port 46206


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 29 06:53:30 ait sshd[4145921]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 29 06:53:58 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.180.84
description:
2025-01-29 06:53:59 dovecot_plain authenticator failed for ([120.238.180.84]) [120.238.180.84]:59504: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-29 06:54:00 dovecot_plain authenticator failed for (sking) [109.166.70.166]:40966: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 06:55:50 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.48.104.200
description:
2025-01-29 06:55:50 dovecot_plain authenticator failed for ([112.48.104.200]) [112.48.104.200]:39356: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.125.43
description:
Jan 29 06:56:03 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.125.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.125.43
description:
2025-01-29 06:56:05 dovecot_plain authenticator failed for ([14.37.125.43]) [14.37.125.43]:58721: 535 Incorrect authentication data (set_id=dagyarko)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-56.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.48.104.200
description:
Jan 29 06:55:48 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.48.104.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 06:56:30 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.168.194
description:
2025-01-29 06:56:41 dovecot_plain authenticator failed for ([65.76.168.194]) [65.76.168.194]:58036: 535 Incorrect authentication data (set_id=larm@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.188.73.223
description:
2025-01-29 06:56:52 dovecot_plain authenticator failed for ([27.188.73.223]) [27.188.73.223]:54600: 535 Incorrect authentication data (set_id=larm)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-29 06:56:45 dovecot_plain authenticator failed for ([121.189.226.81]) [121.189.226.81]:39154: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.188.73.223
description:
Jan 29 06:56:50 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.188.73.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.241.64.92
description:
Jan 29 06:56:56 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.241.64.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 29 06:56:20 ait sshd[4147035]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 29 06:56:20 ait sshd[4147035]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.168.194
description:
Jan 29 06:56:39 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.168.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 29 06:56:43 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.92
description:
2025-01-29 06:56:58 dovecot_plain authenticator failed for ([1.241.64.92]) [1.241.64.92]:45103: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.175
description:
Jan 29 06:57:50 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 06:57:52 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.175
description:
2025-01-29 06:57:52 dovecot_plain authenticator failed for (92.62.243.175.fibermax.bg) [92.62.243.175]:40912: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.177
description:
2025-01-29 06:58:01 dovecot_plain authenticator failed for ([167.250.119.177]) [167.250.119.177]:37458: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.91.200.139
description:
2025-01-29 06:58:19 dovecot_plain authenticator failed for 198-91-200-139.cpe.distributel.net [198.91.200.139]:50032: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.202.94.224
description:
2025-01-29 06:59:09 dovecot_plain authenticator failed for o6z8xc.static.otenet.gr [87.202.94.224]:33678: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:06-58.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.130.160
description:
Jan 29 06:58:56 ait auth[4123017]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.130.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.130.160
description:
2025-01-29 06:58:58 dovecot_plain authenticator failed for ([165.220.130.160]) [165.220.130.160]:34762: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
description:
2025-01-29 07:02:08 dovecot_plain authenticator failed for ([61.81.133.182]) [61.81.133.182]:59701: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 07:01:56 ait sshd[4149854]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 07:01:56 ait sshd[4149854]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.34.17.130
description:
2025-01-29 07:01:56 dovecot_plain authenticator failed for ([59.34.17.130]) [59.34.17.130]:53867: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.91.170
description:
2025-01-29 07:02:58 dovecot_plain authenticator failed for ([103.250.160.76]) [117.198.91.170]:50339: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.91.170
description:
Jan 29 07:02:56 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.91.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.76
description:
Jan 29 07:02:22 ait sshd[4150138]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.81.140.83
description:
2025-01-29 07:03:05 dovecot_plain authenticator failed for ([42.81.140.83]) [42.81.140.83]:46085: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.81.140.83
description:
Jan 29 07:03:03 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.81.140.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.76
description:
Jan 29 07:02:22 ait sshd[4150138]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.76


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-01-29 07:03:07 dovecot_plain authenticator failed for ([200.165.163.121]) [200.165.148.166]:49773: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.171.157
description:
2025-01-29 07:03:16 dovecot_plain authenticator failed for ([220.180.171.157]) [220.180.171.157]:46812: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.90.122.156
description:
Jan 29 07:04:00 ait sshd[4150836]: pam_imunify(sshd:auth): [IM360_RBL] The IP 91.90.122.156 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 91.90.122.156
description:
Jan 29 07:04:00 ait sshd[4150836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=91.90.122.156


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 07:04:18 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 07:04:20 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:60434: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.132.194.52
description:
Jan 29 07:03:36 ait sshd[4150628]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.132.194.52


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.189.114.119
description:
Jan 29 07:03:47 ait sshd[4150790]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.189.114.119 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.189.114.119
description:
Jan 29 07:03:47 ait sshd[4150790]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.189.114.119


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-29 07:04:26 dovecot_login authenticator failed for (hostglobal.plus) [78.153.140.202]:60434: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 07:05:07 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 29 07:04:24 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.85.188
description:
Jan 29 07:04:24 ait sshd[4150900]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.255.85.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.255.85.188
description:
Jan 29 07:04:24 ait sshd[4150900]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.255.85.188


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.134.209.86
description:
2025-01-29 07:05:52 dovecot_plain authenticator failed for ([183.134.209.86]) [183.134.209.86]:41654: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 29 07:05:56 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.43.146
description:
2025-01-29 07:05:58 dovecot_plain authenticator failed for (201-91-196-177.customer.tdatabrasil.net.br) [186.238.43.146]:39616: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 175.126.195.176
description:
Jan 29 07:05:46 ait sshd[4151474]: Invalid user universitypublishing from 175.126.195.176 port 44172


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 07:05:46 ait sshd[4151474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.43.146
description:
Jan 29 07:05:56 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.43.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.40.151
description:
Jan 29 07:05:58 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.40.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.34
description:
2025-01-29 07:06:15 dovecot_plain authenticator failed for ([171.244.63.34]) [171.244.63.34]:19193: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.125.94
description:
2025-01-29 07:05:40 dovecot_plain authenticator failed for ([111.171.125.94]) [111.171.125.94]:49838: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.125.94
description:
Jan 29 07:05:38 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.125.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 07:05:46 ait sshd[4151474]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.40.151
description:
2025-01-29 07:06:00 dovecot_plain authenticator failed for 96-1-40-151-staticipeast.wireless.telus.com [96.1.40.151]:54137: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 07:05:34 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 07:07:02 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.164.193.182
description:
Jan 29 07:08:04 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.164.193.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.164.193.182
description:
2025-01-29 07:08:06 dovecot_plain authenticator failed for ([123.164.193.182]) [123.164.193.182]:43565: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 29 07:08:14 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.72.203.252
description:
2025-01-29 07:08:15 dovecot_plain authenticator failed for 212-72-203-252.ip.btc-net.bg [212.72.203.252]:52498: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 29 07:07:59 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-29 07:08:01 dovecot_plain authenticator failed for (unshles) [164.92.243.206]:53650: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 29 07:08:47 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.243.68.66
description:
Jan 29 07:08:31 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.243.68.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.52.103.241
description:
Jan 29 07:08:32 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.52.103.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.52.103.241
description:
2025-01-29 07:08:34 dovecot_plain authenticator failed for ([14.52.103.241]) [14.52.103.241]:50830: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-29 07:08:49 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (eptilible) [91.56.31.167]:59263: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.189.122.139
description:
Jan 29 07:08:24 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.189.122.139 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
description:
2025-01-29 07:08:26 dovecot_plain authenticator failed for ([106.245.246.26]) [106.245.246.26]:40397: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.234
description:
2025-01-29 07:08:42 dovecot_plain authenticator failed for ([116.114.84.234]) [116.114.84.234]:46948: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.63.46.34
description:
2025-01-29 07:09:19 dovecot_plain authenticator failed for ([203.29.84.253]) [203.63.46.34]:30498: 535 Incorrect authentication data (set_id=ads21b00152y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-29 07:08:37 dovecot_plain authenticator failed for ([37.224.119.19]) [37.224.119.19]:57032: 535 Incorrect authentication data (set_id=tsagli)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.234
description:
Jan 29 07:08:40 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-29 07:09:11 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (quoiforsed) [62.63.230.241]:60838: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.245.246.26
description:
Jan 29 07:08:24 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.245.246.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.189.122.139
description:
2025-01-29 07:08:26 dovecot_plain authenticator failed for wsip-184-189-122-139.oc.oc.cox.net [184.189.122.139]:55708: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.63.46.34
description:
Jan 29 07:09:17 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.63.46.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.3
description:
2025-01-29 07:09:34 dovecot_plain authenticator failed for (nsg-corporate-3.234.187.122.airtel.in) [122.187.234.3]:57727: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-29 07:09:46 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (neces) [2.139.88.148]:55450: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-10.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 29 07:09:23 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.28.76
description:
2025-01-29 07:09:22 dovecot_plain authenticator failed for ([120.238.28.76]) [120.238.28.76]:60728: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.21.12.36
description:
Jan 29 07:09:29 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.21.12.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.21.12.36
description:
2025-01-29 07:09:31 dovecot_plain authenticator failed for ([210.21.12.36]) [210.21.12.36]:59222: 535 Incorrect authentication data (set_id=ads21b00152y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 29 07:09:44 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-29 07:10:07 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (beweer) [62.63.230.241]:35184: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.244.164.239
description:
Jan 29 07:10:41 ait sshd[4153395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.244.164.239  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-29 07:11:16 dovecot_plain authenticator failed for ([121.186.131.108]) [121.186.131.108]:50712: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.99.225.161
description:
2025-01-29 07:11:37 dovecot_plain authenticator failed for (institutognosis.static.gvt.net.br) [177.99.225.161]:43590: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.149.60
description:
Jan 29 07:11:53 ait sshd[4153699]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.149.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.149.60
description:
Jan 29 07:11:53 ait sshd[4153699]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.149.60


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.91.34
description:
Jan 29 07:12:30 ait sshd[4154044]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.91.34


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-29 07:12:40 dovecot_plain authenticator failed for (belinneed) [109.166.70.166]:50720: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 29 07:12:38 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.104.193
description:
Jan 29 07:14:18 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.104.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 143.244.164.239
description:
Jan 29 07:13:39 ait sshd[4154359]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=143.244.164.239  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.149.60
description:
Jan 29 07:14:07 ait sshd[4154715]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.149.60 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.149.60
description:
Jan 29 07:14:07 ait sshd[4154715]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.149.60


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.104.193
description:
2025-01-29 07:14:20 dovecot_plain authenticator failed for 110-25-104-193.adsl.fetnet.net [110.25.104.193]:37521: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Jan 29 07:14:32 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.140.1.50
description:
Jan 29 07:14:45 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.140.1.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 29 07:15:06 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.120
description:
Jan 29 07:14:29 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.120
description:
2025-01-29 07:14:31 dovecot_plain authenticator failed for ([121.202.152.120]) [121.202.152.120]:1923: 535 Incorrect authentication data (set_id=abs20b00166y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-01-29 07:14:34 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:60559: 535 Incorrect authentication data (set_id=ads15a00028y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.76
description:
Jan 29 07:14:39 ait sshd[4154908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.76


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 07:15:07 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.76
description:
Jan 29 07:14:39 ait sshd[4154908]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.140.1.50
description:
2025-01-29 07:14:47 dovecot_plain authenticator failed for ([113.140.1.50]) [113.140.1.50]:48507: 535 Incorrect authentication data (set_id=ads15a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-29 07:15:08 dovecot_plain authenticator failed for (buropous) [147.235.97.158]:16533: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 192.210.149.60
description:
Jan 29 07:15:48 ait sshd[4155501]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.210.149.60  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.200.160
description:
2025-01-29 07:16:02 dovecot_plain authenticator failed for ([222.114.200.160]) [222.114.200.160]:48778: 535 Incorrect authentication data (set_id=eng20a00022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.136.164.157
description:
Jan 29 07:16:09 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.136.164.157 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-15.194.163.182.227


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.210.149.60
description:
Jan 29 07:15:48 ait sshd[4155501]: pam_imunify(sshd:auth): [IM360_RBL] The IP 192.210.149.60 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.200.160
description:
Jan 29 07:16:00 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.200.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.136.164.157
description:
2025-01-29 07:16:11 dovecot_plain authenticator failed for c-76-136-164-157.hsd1.il.comcast.net [76.136.164.157]:40026: 535 Incorrect authentication data (set_id=eng20a00022y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 29 07:17:01 ait sshd[4156025]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.227.201.53
description:
[2025-01-29 07:16:22 +0100] info [cpaneld] 212.227.201.53 - iric.usadministratorindex.php) "POST /login/ HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 29 07:16:25 ait sshd[4155804]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.60.146
description:
Jan 29 07:16:52 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.106.78.215
description:
Jan 29 07:17:01 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.106.78.215 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 29 07:17:01 ait sshd[4156025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.106.78.215
description:
2025-01-29 07:17:03 dovecot_plain authenticator failed for ([77.106.78.215]) [77.106.78.215]:12919: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 29 07:16:25 ait sshd[4155804]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.0.234.38
description:
Jan 29 07:16:42 ait sshd[4155844]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.0.234.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.0.234.38
description:
Jan 29 07:16:42 ait sshd[4155844]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.0.234.38


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-01-29 07:16:54 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:56815: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 29 07:17:48 ait sshd[4156274]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 29 07:18:03 ait sshd[4156485]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.71.238.4
description:
Jan 29 07:17:36 ait sshd[4156062]: pam_imunify(sshd:auth): [IM360_RBL] The IP 115.71.238.4 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 115.71.238.4
description:
Jan 29 07:17:36 ait sshd[4156062]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.71.238.4


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 29 07:17:48 ait sshd[4156274]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219  user=mysql


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 29 07:18:03 ait sshd[4156485]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 29 07:17:41 ait sshd[4156269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.156.208.66
description:
Jan 29 07:18:10 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.156.208.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.156.2.212
description:
2025-01-29 07:18:17 dovecot_plain authenticator failed for 212.2.156.220.rev.iijmobile.jp [220.156.2.212]:60839: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 29 07:17:41 ait sshd[4156269]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.126.247
description:
Jan 29 07:18:00 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.126.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.126.247
description:
2025-01-29 07:18:02 dovecot_plain authenticator failed for ([112.172.126.247]) [112.172.126.247]:54392: 535 Incorrect authentication data (set_id=ug88m8880009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.208.66
description:
2025-01-29 07:18:12 dovecot_plain authenticator failed for ([115.244.25.186]) [103.156.208.66]:55378: 535 Incorrect authentication data (set_id=ug88m8880009)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.156.2.212
description:
Jan 29 07:18:15 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.156.2.212 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.91.34
description:
Jan 29 07:18:13 ait sshd[4156508]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.91.34


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.110.44.221
description:
Jan 29 07:18:23 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.110.44.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.110.44.221
description:
2025-01-29 07:18:25 dovecot_plain authenticator failed for broadband-37-110-44-221.ip.moscow.rt.ru [37.110.44.221]:16482: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.122.17.2
description:
Jan 29 07:19:37 ait sshd[4156807]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.122.17.2  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 29 07:20:13 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 29 07:20:22 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.222.190.70
description:
Jan 29 07:21:47 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.222.190.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.222.190.70
description:
2025-01-29 07:21:49 dovecot_plain authenticator failed for (client.fttb.2day.kz) [176.222.190.70]:57030: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-21.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.193.163.2
description:
Jan 29 07:22:03 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.193.163.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.193.163.2
description:
2025-01-29 07:22:05 dovecot_plain authenticator failed for ([1.193.163.2]) [1.193.163.2]:37947: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 202.122.17.2
description:
Jan 29 07:22:55 ait sshd[4158474]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=202.122.17.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 29 07:23:09 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.91.34
description:
Jan 29 07:23:12 ait sshd[4158818]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.91.34


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-29 07:23:13 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:40442: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 29 07:23:11 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-29 07:23:11 dovecot_plain authenticator failed for ([67.213.230.122]) [67.213.230.122]:53395: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
description:
2025-01-29 07:23:24 dovecot_plain authenticator failed for 157.ip-51-75-142.eu [51.75.142.157]:41928: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 29 07:23:29 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 29 07:23:52 ait sshd[4159067]: Invalid user universitypublishing from 116.122.157.193 port 35876


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.0.200
description:
Jan 29 07:24:07 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.0.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.0.200
description:
2025-01-29 07:24:09 dovecot_plain authenticator failed for ([218.22.0.200]) [218.22.0.200]:36812: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.170.200
description:
2025-01-29 07:23:23 dovecot_plain authenticator failed for ([37.204.170.200]) [37.204.170.200]:58506: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 07:23:53 ait sshd[4159067]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 07:23:53 ait sshd[4159067]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
description:
Jan 29 07:23:22 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 29 07:24:19 ait sshd[4159227]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.170.200
description:
Jan 29 07:23:21 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.170.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.197.38.12
description:
Jan 29 07:23:55 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.197.38.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.197.38.12
description:
2025-01-29 07:23:57 dovecot_plain authenticator failed for ([181.197.38.12]) [181.197.38.12]:59374: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 29 07:24:19 ait sshd[4159227]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-29 07:24:33 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (obatoric) [51.255.84.180]:40206: 535 Incorrect authentication data (set_id=eng20a00114y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Jan 29 07:24:53 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-01-29 07:24:55 dovecot_plain authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:54133: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.186
description:
2025-01-29 07:25:11 dovecot_plain authenticator failed for ([121.202.153.186]) [121.202.153.186]:29965: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 31.45.34.127
description:
Jan 29 07:24:21 ait sshd[4159227]: Failed password for invalid user ait from 31.45.34.127 port 49800 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 29 07:24:31 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.186
description:
Jan 29 07:25:09 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.186 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 27.254.235.2
description:
Jan 29 07:25:44 ait sshd[4159908]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=27.254.235.2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
description:
Jan 29 07:26:17 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
description:
2025-01-29 07:26:19 dovecot_plain authenticator failed for c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:35074: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.58.187.101
description:
Jan 29 07:26:33 ait sshd[4160268]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.58.187.101 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.58.187.101
description:
Jan 29 07:26:33 ait sshd[4160268]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.58.187.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
description:
Jan 29 07:26:38 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
description:
2025-01-29 07:26:40 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:59446: 535 Incorrect authentication data (set_id=yeboah)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 194.163.182.227
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:07-27.194.163.182.227


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.213.101
description:
Jan 29 07:27:33 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.213.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.213.101
description:
2025-01-29 07:27:35 dovecot_login authenticator failed for ([65.20.213.101]) [65.20.213.101]:42664: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 29 07:28:07 ait sshd[4160907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-29 07:28:18 dovecot_plain authenticator failed for (anonia) [37.224.119.19]:37022: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 29 07:27:40 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-29 07:27:42 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:49248: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 29 07:28:07 ait sshd[4160907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 29 07:28:16 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 29 07:29:14 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-29 07:29:16 dovecot_plain authenticator failed for ([91.234.132.226]) [91.234.132.226]:36332: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 29 07:30:16 ait auth[4150392]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


