# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Jan 28 09:20:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-01-28 09:20:44 dovecot_login authenticator failed for ([223.241.100.90]) [223.241.100.90]:49298: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-28 09:19:46 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:44774: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
description:
2025-01-28 09:19:54 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:56534: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Jan 28 09:20:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 101.201.108.203
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-21.101.201.108.203


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 28 09:20:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-28 09:20:48 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:54660: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.103.88
description:
[2025-01-28 09:20:49 +0100] info [webmaild] 45.230.103.88 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-28 09:20:53 dovecot_plain authenticator failed for ([211.105.223.49]) [211.105.223.49]:44144: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 28 09:20:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.30
description:
2025-01-28 09:21:54 dovecot_login authenticator failed for ([60.167.19.30]) [60.167.19.30]:49600: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.180.162.26
description:
2025-01-28 09:22:39 dovecot_plain authenticator failed for ([42.180.162.26]) [42.180.162.26]:56660: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 28 09:22:15 ait sshd[3525704]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-28 09:22:28 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:54173: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.30.24
description:
2025-01-28 09:22:06 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:42621: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.5
description:
Jan 28 09:22:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 28 09:22:15 ait sshd[3525704]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.5
description:
2025-01-28 09:22:14 dovecot_login authenticator failed for ([111.61.97.5]) [111.61.97.5]:26790: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 28 09:22:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.245.37
description:
2025-01-28 09:22:27 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:39750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.180.162.26
description:
Jan 28 09:22:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.180.162.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.30
description:
Jan 28 09:21:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.30.24
description:
Jan 28 09:22:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.30.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.245.37
description:
Jan 28 09:22:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.245.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.89.54.10
description:
2025-01-28 09:23:17 dovecot_plain authenticator failed for ip10.ip-51-89-54.eu [51.89.54.10]:57949: 535 Incorrect authentication data (set_id=sng26b99239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
description:
Jan 28 09:23:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
description:
2025-01-28 09:23:41 dovecot_login authenticator failed for (Mail.chinaqiaoyu.com) [222.185.255.227]:38952: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.89.54.10
description:
Jan 28 09:23:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.89.54.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.69.157.215
description:
2025-01-28 09:23:57 dovecot_plain authenticator failed for ([151.69.157.215]) [151.69.157.215]:54414: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.6.28.255
description:
[2025-01-28 09:24:01 +0100] info [webmaild] 179.6.28.255 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.104.144.93
description:
Jan 28 09:24:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.104.144.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.104.144.93
description:
2025-01-28 09:24:25 dovecot_login authenticator failed for ([86.104.144.93]) [86.104.144.93]:37256: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.195.77.177
description:
Jan 28 09:24:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.195.77.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.44.171
description:
Jan 28 09:24:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.44.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-28 09:24:16 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:39435: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 09:24:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.219.157
description:
2025-01-28 09:23:52 dovecot_login authenticator failed for ([94.205.219.157]) [94.205.219.157]:37850: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.48.248
description:
47.128.48.248 - - [28/Jan/2025:09:23:59 +0100] "GET /images/google.png HTTP/2.0" 415 176 ait-edu.us "https://ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=23203401" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.48.248


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.219.157
description:
Jan 28 09:23:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.219.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.69.157.215
description:
Jan 28 09:23:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.69.157.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.44.171
description:
2025-01-28 09:24:17 dovecot_plain authenticator failed for ([222.128.44.171]) [222.128.44.171]:2242: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 09:25:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 09:25:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-28 09:25:45 dovecot_login authenticator failed for ([216.194.174.74]) [216.194.174.27]:58057: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 09:25:08 ait sshd[3527109]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 09:25:08 ait sshd[3527109]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 28 09:25:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
description:
2025-01-28 09:26:29 dovecot_login authenticator failed for (227.69.57.37.triolan.net) [37.57.69.227]:46680: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 28 09:26:07 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-28 09:26:09 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:39375: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
description:
2025-01-28 09:26:15 dovecot_login authenticator failed for ([210.97.109.192]) [210.97.109.192]:34135: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
description:
Jan 28 09:26:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.250.41.11
description:
Jan 28 09:26:43 ait sshd[3527758]: pam_imunify(sshd:auth): [IM360_RBL] The IP 220.250.41.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.15.155.176
description:
Jan 28 09:26:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.15.155.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.97.109.192
description:
Jan 28 09:26:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.97.109.192 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.84.91.167
description:
[2025-01-28 09:26:16 +0100] info [webmaild] 187.84.91.167 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.123.231
description:
[2025-01-28 09:26:35 +0100] info [webmaild] 45.226.123.231 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.15.155.176
description:
2025-01-28 09:26:11 dovecot_login authenticator failed for ([203.15.155.176]) [203.15.155.176]:38976: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.58.112
description:
[2025-01-28 09:26:20 +0100] info [webmaild] 45.167.58.112 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 220.250.41.11
description:
Jan 28 09:26:43 ait sshd[3527758]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.250.41.11


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.7.52.183
description:
Jan 28 09:26:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.7.52.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.7.52.183
description:
2025-01-28 09:26:23 dovecot_login authenticator failed for ([110.7.52.183]) [110.7.52.183]:45406: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 28 09:27:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 09:27:18 ait sshd[3528107]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.139.39.150
description:
2025-01-28 09:27:27 dovecot_plain authenticator failed for ([182.139.39.150]) [182.139.39.150]:57124: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 220.250.41.11
description:
Jan 28 09:26:46 ait sshd[3527758]: Failed password for invalid user hdm from 220.250.41.11 port 54464 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 28 09:27:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.93.66
description:
2025-01-28 09:27:13 dovecot_plain authenticator failed for ([181.233.93.3]) [181.233.93.66]:57611: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.15.177.173
description:
Jan 28 09:26:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.15.177.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.22.247.178
description:
Jan 28 09:27:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.22.247.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-28 09:27:05 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.138]:42020: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.134.197.47
description:
[2025-01-28 09:27:24 +0100] info [webmaild] 186.134.197.47 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.22.247.178
description:
2025-01-28 09:27:04 dovecot_login authenticator failed for ([115.22.247.178]) [115.22.247.178]:59635: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-28 09:27:17 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:50421: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.221.38.226
description:
Jan 28 09:27:35 ait sshd[3528136]: pam_imunify(sshd:auth): [IM360_RBL] The IP 223.221.38.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 09:27:07 ait sshd[3527921]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.139.39.150
description:
Jan 28 09:27:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.139.39.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 09:27:07 ait sshd[3527921]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 28 09:26:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-28 09:26:52 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:38148: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.15.177.173
description:
2025-01-28 09:26:53 dovecot_plain authenticator failed for ([121.15.177.173]) [121.15.177.173]:49858: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 09:27:18 ait sshd[3528107]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 223.221.38.226
description:
Jan 28 09:27:35 ait sshd[3528136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.221.38.226


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.93.66
description:
Jan 28 09:27:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.93.66 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 178.23.230.215
description:
[2025-01-28 09:27:10 +0100] info [webmaild] 178.23.230.215 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.250
description:
Jan 28 09:28:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.34
description:
Jan 28 09:28:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-28 09:28:24 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:39750: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.34
description:
2025-01-28 09:28:26 dovecot_login authenticator failed for (m121-202-155-34.smartone.com) [121.202.155.34]:43486: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.250
description:
2025-01-28 09:28:39 dovecot_login authenticator failed for (m121-202-154-250.smartone.com) [121.202.154.250]:18639: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.86.126.142
description:
[2025-01-28 09:27:50 +0100] info [webmaild] 177.86.126.142 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.167.53.62
description:
[2025-01-28 09:28:05 +0100] info [webmaild] 45.167.53.62 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 28 09:28:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.92.215
description:
Jan 28 09:29:20 ait sshd[3528970]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.92.215


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-28 09:29:21 dovecot_login authenticator failed for ([221.215.87.163]) [221.215.87.163]:53518: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-28 09:29:23 dovecot_login authenticator failed for ([112.176.249.35]) [112.176.249.35]:35034: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.29.206.193
description:
[2025-01-28 09:29:32 +0100] info [webmaild] 176.29.206.193 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.130.224.233
description:
Jan 28 09:28:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.130.224.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.130.224.233
description:
2025-01-28 09:28:47 dovecot_login authenticator failed for ([220.189.239.206]) [61.130.224.233]:45234: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.238.239.4
description:
[2025-01-28 09:28:58 +0100] info [webmaild] 45.238.239.4 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.34.188
description:
2025-01-28 09:29:32 dovecot_login authenticator failed for ([5.26.34.188]) [5.26.34.188]:55910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
description:
Jan 28 09:29:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-01-28 09:29:35 dovecot_login authenticator failed for (m121-202-152-165.smartone.com) [121.202.152.165]:41219: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.239.180.114
description:
[2025-01-28 09:28:49 +0100] info [webmaild] 170.239.180.114 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 28 09:29:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.26.34.188
description:
Jan 28 09:29:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.26.34.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.92.215
description:
Jan 28 09:29:20 ait sshd[3528970]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.92.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.41.202.12
description:
Jan 28 09:29:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.41.202.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 28 09:29:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-28 09:29:08 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:50840: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 28 09:29:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.41.202.12
description:
2025-01-28 09:29:30 dovecot_login authenticator failed for syn-071-041-202-012.biz.spectrum.com [71.41.202.12]:39727: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 28 09:29:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.131.241.150
description:
[2025-01-28 09:29:44 +0100] info [webmaild] 201.131.241.150 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 28 09:30:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.221.38.226
description:
Jan 28 09:30:21 ait sshd[3529571]: pam_imunify(sshd:auth): [IM360_RBL] The IP 223.221.38.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.73.174
description:
Jan 28 09:30:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.73.174 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 223.221.38.226
description:
Jan 28 09:30:21 ait sshd[3529571]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.221.38.226  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.109.233.181
description:
2025-01-28 09:30:23 dovecot_login authenticator failed for (ipoe-static.mosoblast.rt.ru) [89.109.233.181]:45145: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.239.109.147
description:
2025-01-28 09:30:33 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:39244: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Jan 28 09:29:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.118
description:
Jan 28 09:29:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.118
description:
2025-01-28 09:29:58 dovecot_login authenticator failed for (m121-202-155-118.smartone.com) [121.202.155.118]:2365: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 87.120.112.46
domain: afaccra.u3l.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-30.87.120.112.46


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 28 09:30:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-28 09:30:43 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:47612: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.109.233.181
description:
Jan 28 09:30:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.109.233.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-01-28 09:29:52 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl (obemater) [188.127.16.197]:58926: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.73.174
description:
2025-01-28 09:30:11 dovecot_login authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.73.174]:62138: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-28 09:30:14 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:59071: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.53.180.209
description:
[2025-01-28 09:29:46 +0100] info [webmaild] 191.53.180.209 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-28 09:29:46 dovecot_login authenticator failed for (170.250.152.88.hwccustomers.com) [170.250.152.88]:36500: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.239.109.147
description:
Jan 28 09:30:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.239.109.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 28 09:31:34 ait sshd[3530079]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.139.110.118
description:
Jan 28 09:31:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.139.110.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 09:31:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-01-28 09:31:02 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:57972: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.232.175.64
description:
2025-01-28 09:31:12 dovecot_plain authenticator failed for ([37.232.175.64]) [37.232.175.64]:50480: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 28 09:31:34 ait sshd[3530079]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.139.110.118
description:
2025-01-28 09:31:40 dovecot_plain authenticator failed for (pente) [37.139.110.118]:56632: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.125.194.23
description:
[2025-01-28 09:30:54 +0100] info [webmaild] 177.125.194.23 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Jan 28 09:31:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.232.175.64
description:
Jan 28 09:31:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.232.175.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.208
description:
Jan 28 09:31:30 ait sshd[3530065]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.208 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.208
description:
Jan 28 09:31:30 ait sshd[3530065]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.208


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 28 09:32:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.231.86.234
description:
[2025-01-28 09:32:10 +0100] info [webmaild] 45.231.86.234 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.166.214
description:
Jan 28 09:32:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.166.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Jan 28 09:32:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.125.32
description:
Jan 28 09:32:33 ait sshd[3530426]: pam_imunify(sshd:auth): [IM360_RBL] The IP 24.199.125.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-01-28 09:32:34 dovecot_login authenticator failed for ([220.77.245.227]) [220.77.245.227]:51826: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.228.225.20
description:
Jan 28 09:32:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.228.225.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.209.248.22
description:
Jan 28 09:32:36 ait sshd[3530433]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.209.248.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.20
description:
2025-01-28 09:32:25 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:51216: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.123.219.82
description:
2025-01-28 09:32:44 dovecot_login authenticator failed for ool-457bdb52.dyn.optonline.net [69.123.219.82]:42653: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
description:
Jan 28 09:32:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 09:32:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-28 09:32:36 dovecot_login authenticator failed for ([2.57.219.6]) [2.57.219.2]:45258: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.226
description:
Jan 28 09:32:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 24.199.125.32
description:
Jan 28 09:32:33 ait sshd[3530426]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.199.125.32


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-28 09:32:34 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (veaplu) [81.237.110.29]:60768: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-28 09:32:42 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:47176: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.209.248.22
description:
Jan 28 09:32:36 ait sshd[3530433]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.209.248.22


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.141
description:
2025-01-28 09:32:20 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:35975: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.166.214
description:
2025-01-28 09:32:27 dovecot_plain authenticator failed for ([220.180.166.214]) [220.180.166.214]:60299: 535 Incorrect authentication data (set_id=abs18b00059y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.226
description:
2025-01-28 09:32:32 dovecot_login authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:50029: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
description:
2025-01-28 09:32:16 dovecot_plain authenticator failed for ([223.210.27.53]) [223.210.27.53]:33286: 535 Incorrect authentication data (set_id=abs18b00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.141
description:
Jan 28 09:32:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 28 09:32:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 28 09:32:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.123.219.82
description:
Jan 28 09:32:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.123.219.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.121.195.38
description:
Jan 28 09:33:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.121.195.38 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.80.35.45
description:
Jan 28 09:32:52 ait sshd[3530478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.80.35.45


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 28 09:32:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 09:33:21 ait sshd[3530813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 28 09:33:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-28 09:33:24 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:58432: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-28 09:32:58 dovecot_login authenticator failed for mail.infologic.co.il [85.130.200.51]:57489: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.126.92.215
description:
Jan 28 09:32:58 ait sshd[3530500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 101.126.92.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.80.35.45
description:
Jan 28 09:32:52 ait sshd[3530478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.80.35.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.133.17.20
description:
Jan 28 09:33:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.133.17.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.121.195.38
description:
2025-01-28 09:33:11 dovecot_login authenticator failed for ([190.121.195.38]) [190.121.195.38]:41567: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.212.108.87
description:
Jan 28 09:33:20 ait sshd[3530809]: pam_imunify(sshd:auth): [IM360_RBL] The IP 177.212.108.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 177.212.108.87
description:
Jan 28 09:33:20 ait sshd[3530809]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.212.108.87


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
description:
Jan 28 09:32:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
description:
2025-01-28 09:32:58 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:24144: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.133.17.20
description:
2025-01-28 09:33:10 dovecot_login authenticator failed for ([120.133.17.20]) [120.133.17.20]:21544: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 09:32:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.221.38.226
description:
Jan 28 09:33:34 ait sshd[3530868]: pam_imunify(sshd:auth): [IM360_RBL] The IP 223.221.38.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.92.215
description:
Jan 28 09:32:58 ait sshd[3530500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.92.215


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 09:33:21 ait sshd[3530813]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 223.221.38.226
description:
Jan 28 09:33:34 ait sshd[3530868]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=223.221.38.226


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 28 09:34:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.152.28
description:
Jan 28 09:34:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.152.28 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.29.32
description:
Jan 28 09:34:34 ait sshd[3531232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.29.32


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.111.22
description:
Jan 28 09:34:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.111.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-28 09:34:24 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:12445: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.28
description:
2025-01-28 09:34:33 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.28]:34889: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.111.22
description:
2025-01-28 09:34:44 dovecot_plain authenticator failed for ([110.34.111.22]) [110.34.111.22]:39845: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 09:34:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.29.32
description:
Jan 28 09:34:34 ait sshd[3531232]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.29.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 28 09:34:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-28 09:34:43 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:34713: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.169.234
description:
Jan 28 09:35:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.169.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.147.103
description:
Jan 28 09:34:58 ait sshd[3531330]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.187.147.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.187.147.103
description:
Jan 28 09:34:58 ait sshd[3531330]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.103


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
description:
2025-01-28 09:35:02 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:42066: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.20.88.188
description:
Jan 28 09:35:28 ait sshd[3531713]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.20.88.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.44.246.82
description:
Jan 28 09:35:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.44.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.20.88.188
description:
Jan 28 09:35:28 ait sshd[3531713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.20.88.188


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.236.70.6
description:
Jan 28 09:35:34 ait sshd[3531729]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.70.6  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.169.234
description:
2025-01-28 09:35:43 dovecot_plain authenticator failed for (midecores) [65.20.169.234]:53402: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 28 09:34:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.127.16.197
description:
Jan 28 09:34:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.127.16.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.127.16.197
description:
2025-01-28 09:34:58 dovecot_plain authenticator failed for ip-188-127-16-197.ennet.pl (cogar) [188.127.16.197]:54012: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.196.178.203
description:
[2025-01-28 09:34:46 +0100] info [webmaild] 91.196.178.203 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-28 09:34:51 dovecot_login authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:56710: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.172.189.90
description:
Jan 28 09:36:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.172.189.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.125.32
description:
Jan 28 09:36:09 ait sshd[3531939]: pam_imunify(sshd:auth): [IM360_RBL] The IP 24.199.125.32 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 24.199.125.32
description:
Jan 28 09:36:09 ait sshd[3531939]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.199.125.32


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 177.212.108.87
description:
Jan 28 09:36:23 ait sshd[3532124]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.212.108.87


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.252.57
description:
2025-01-28 09:35:54 dovecot_login authenticator failed for ([60.223.252.57]) [60.223.252.57]:34206: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-01-28 09:35:58 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:62317: 535 Incorrect authentication data (set_id=ads19a00054y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.27.234.178
description:
Jan 28 09:36:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.27.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Jan 28 09:35:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.172.189.90
description:
2025-01-28 09:36:28 dovecot_login authenticator failed for ([112.172.189.90]) [112.172.189.90]:56174: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.29.32
description:
Jan 28 09:36:21 ait sshd[3532118]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.29.32


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
description:
2025-01-28 09:36:21 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:39596: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.80.35.45
description:
Jan 28 09:36:24 ait sshd[3532127]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.80.35.45 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.80.35.45
description:
Jan 28 09:36:24 ait sshd[3532127]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.80.35.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-28 09:36:42 dovecot_login authenticator failed for ([71.27.234.178]) [71.27.234.178]:48378: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.252.57
description:
Jan 28 09:35:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.252.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
description:
Jan 28 09:36:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 09:36:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.191.166
description:
2025-01-28 09:36:35 dovecot_plain authenticator failed for ([39.155.191.166]) [39.155.191.166]:19960: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.186
description:
Jan 28 09:36:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.186
description:
2025-01-28 09:36:07 dovecot_login authenticator failed for ([111.61.177.186]) [111.61.177.186]:36602: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.212.108.87
description:
Jan 28 09:36:23 ait sshd[3532124]: pam_imunify(sshd:auth): [IM360_RBL] The IP 177.212.108.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.191.166
description:
Jan 28 09:36:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.191.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.245.227
description:
Jan 28 09:36:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.245.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.245.227
description:
2025-01-28 09:36:10 dovecot_plain authenticator failed for ([220.77.245.227]) [220.77.245.227]:32868: 535 Incorrect authentication data (set_id=ads19a00054y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.29.32
description:
Jan 28 09:36:21 ait sshd[3532118]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.29.32 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 185.87.21.158
domain: tracker.aitedu.net
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:09-36.185.87.21.158||RSV:6.65||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.81.213
description:
Jan 28 09:37:14 ait sshd[3532327]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.81.213


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.199.125.32
description:
Jan 28 09:37:26 ait sshd[3532517]: pam_imunify(sshd:auth): [IM360_RBL] The IP 24.199.125.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.208
description:
Jan 28 09:37:37 ait sshd[3532599]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.208 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.208
description:
Jan 28 09:37:37 ait sshd[3532599]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.208


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.20.88.188
description:
Jan 28 09:37:06 ait sshd[3532304]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.20.88.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.20.88.188
description:
Jan 28 09:37:06 ait sshd[3532304]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.20.88.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.81.140.83
description:
Jan 28 09:37:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.81.140.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 24.199.125.32
description:
Jan 28 09:37:26 ait sshd[3532517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=24.199.125.32


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.209.248.22
description:
Jan 28 09:36:46 ait sshd[3532206]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.209.248.22 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.209.248.22
description:
Jan 28 09:36:46 ait sshd[3532206]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.209.248.22


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.147.103
description:
Jan 28 09:37:42 ait sshd[3532608]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.187.147.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.187.147.103
description:
Jan 28 09:37:42 ait sshd[3532608]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.103


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.20.88.188
description:
Jan 28 09:38:31 ait sshd[3533319]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.20.88.188


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 28 09:38:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.163.50.53
description:
[2025-01-28 09:38:39 +0100] info [webmaild] 191.163.50.53 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.80.35.45
description:
Jan 28 09:38:10 ait sshd[3532932]: pam_imunify(sshd:auth): [IM360_RBL] The IP 41.80.35.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
description:
2025-01-28 09:38:13 dovecot_plain authenticator failed for ([211.169.212.206]) [211.169.212.206]:52473: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.187.147.103
description:
Jan 28 09:37:44 ait sshd[3532608]: Failed password for invalid user server from 103.187.147.103 port 44172 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.157.15
description:
[2025-01-28 09:37:47 +0100] info [webmaild] 186.224.157.15 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.212.108.87
description:
Jan 28 09:37:56 ait sshd[3532670]: pam_imunify(sshd:auth): [IM360_RBL] The IP 177.212.108.87 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 41.80.35.45
description:
Jan 28 09:38:10 ait sshd[3532932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=41.80.35.45


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.74.36
description:
2025-01-28 09:38:26 dovecot_login authenticator failed for ([164.92.74.36]) [164.92.74.36]:43468: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.20.88.188
description:
Jan 28 09:38:31 ait sshd[3533319]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.20.88.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-28 09:38:36 dovecot_login authenticator failed for ([2.110.10.192]) [2.110.10.192]:48038: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 177.212.108.87
description:
Jan 28 09:37:56 ait sshd[3532670]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=177.212.108.87


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.29.32
description:
Jan 28 09:38:04 ait sshd[3532859]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.29.32


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 104.236.70.6
description:
Jan 28 09:38:00 ait sshd[3532714]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.236.70.6  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.29.32
description:
Jan 28 09:38:04 ait sshd[3532859]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.29.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
description:
Jan 28 09:38:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.119.126.81
description:
2025-01-28 09:38:30 dovecot_plain authenticator failed for ([220.119.126.81]) [220.119.126.81]:56964: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 102.209.248.22
description:
Jan 28 09:38:39 ait sshd[3533380]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=102.209.248.22


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.196.163.211
description:
[2025-01-28 09:37:48 +0100] info [webmaild] 217.196.163.211 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.81.213
description:
Jan 28 09:38:00 ait sshd[3532711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.81.213


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 139.59.29.32
description:
Jan 28 09:38:06 ait sshd[3532859]: Failed password for invalid user ftpuser from 139.59.29.32 port 55234 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.119.126.81
description:
Jan 28 09:38:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.119.126.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.74.36
description:
Jan 28 09:38:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.74.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.209.248.22
description:
Jan 28 09:38:39 ait sshd[3533380]: pam_imunify(sshd:auth): [IM360_RBL] The IP 102.209.248.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.4
description:
Jan 28 09:38:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
description:
2025-01-28 09:38:47 dovecot_plain authenticator failed for (oltuawed) [65.20.133.4]:43479: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.18.115.214
description:
[2025-01-28 09:38:53 +0100] info [webmaild] 84.18.115.214 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.195.232.245
description:
[2025-01-28 09:39:23 +0100] info [webmaild] 37.195.232.245 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.147.103
description:
Jan 28 09:39:26 ait sshd[3533861]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.187.147.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.209
description:
Jan 28 09:38:48 ait sshd[3533326]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.93.51.170
description:
[2025-01-28 09:39:00 +0100] info [webmaild] 91.93.51.170 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
description:
Jan 28 09:39:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.187.147.103
description:
Jan 28 09:39:26 ait sshd[3533861]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.187.147.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.195.69.156
description:
Jan 28 09:39:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.195.69.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.195.69.156
description:
2025-01-28 09:39:30 dovecot_login authenticator failed for (net69.195.109-156.krsk.ertelecom.ru) [109.195.69.156]:34957: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.215.111.247
description:
[2025-01-28 09:39:33 +0100] info [webmaild] 179.215.111.247 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.209
description:
Jan 28 09:38:48 ait sshd[3533326]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.209  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
description:
2025-01-28 09:39:18 dovecot_login authenticator failed for ([60.173.114.254]) [60.173.114.254]:45042: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 101.126.81.213
description:
Jan 28 09:38:46 ait sshd[3533430]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=101.126.81.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 28 09:39:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.46.249
description:
47.128.46.249 - - [28/Jan/2025:09:40:13 +0100] "GET /wp-content/uploads/sites/6/2022/05/Smart-Logo.png HTTP/2.0" 415 176 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=14291501" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.46.249


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.30.162.58
description:
2025-01-28 09:40:29 dovecot_plain authenticator failed for ([60.30.162.58]) [60.30.162.58]:55186: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
description:
2025-01-28 09:39:58 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:39688: 535 Incorrect authentication data (set_id=eng20a00052y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.155.22.152
description:
[2025-01-28 09:40:08 +0100] info [webmaild] 196.155.22.152 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.205.231
description:
[2025-01-28 09:40:25 +0100] info [webmaild] 45.171.205.231 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.17.135.158
description:
[2025-01-28 09:40:35 +0100] info [webmaild] 185.17.135.158 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
description:
2025-01-28 09:40:41 dovecot_plain authenticator failed for ([60.214.127.246]) [60.214.127.246]:18286: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-28 09:39:48 dovecot_plain authenticator failed for ([14.97.7.138]) [182.71.173.250]:49146: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
description:
Jan 28 09:39:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
description:
Jan 28 09:40:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.30.162.58
description:
Jan 28 09:40:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.30.162.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.87.251.118
description:
[2025-01-28 09:41:05 +0100] info [webmaild] 201.87.251.118 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.83.0.148
description:
2025-01-28 09:41:20 dovecot_plain authenticator failed for ool-43530094.dyn.optonline.net [67.83.0.148]:63726: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.75.69
description:
2025-01-28 09:41:35 dovecot_plain authenticator failed for ([211.109.75.68]) [211.109.75.69]:50400: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 28 09:41:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-28 09:41:41 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:60515: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.83.0.148
description:
Jan 28 09:41:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.83.0.148 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 167.250.227.85
description:
[2025-01-28 09:41:24 +0100] info [webmaild] 167.250.227.85 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.24.33
description:
Jan 28 09:41:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.24.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.36.24.33
description:
2025-01-28 09:41:28 dovecot_login authenticator failed for ([138.36.24.33]) [138.36.24.33]:59496: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.75.69
description:
Jan 28 09:41:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.75.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.113.17.23
description:
2025-01-28 09:42:27 dovecot_login authenticator failed for ([118.113.17.23]) [118.113.17.23]:33751: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
description:
2025-01-28 09:42:07 dovecot_login authenticator failed for (213.33.204.130.moscow.gldn.net) [213.33.204.130]:56188: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
description:
2025-01-28 09:42:11 dovecot_login authenticator failed for ([196.203.231.220]) [196.203.231.220]:50632: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 28 09:42:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.113.17.23
description:
Jan 28 09:42:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.113.17.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
description:
2025-01-28 09:41:47 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:57734: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.98.161
description:
2025-01-28 09:41:59 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.98.161]:32321: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
description:
Jan 28 09:42:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
description:
Jan 28 09:42:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 09:41:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.98.161
description:
Jan 28 09:41:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.98.161 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.114.50.213
description:
[2025-01-28 09:42:22 +0100] info [webmaild] 186.114.50.213 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-28 09:42:24 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:34066: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
description:
Jan 28 09:41:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 09:43:02 ait sshd[3535265]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.250.41.11
description:
Jan 28 09:42:51 ait sshd[3535232]: pam_imunify(sshd:auth): [IM360_RBL] The IP 220.250.41.11 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 220.250.41.11
description:
Jan 28 09:42:51 ait sshd[3535232]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.250.41.11


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 09:43:02 ait sshd[3535265]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 28 09:44:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 28 09:44:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 28 09:43:46 ait sshd[3535688]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 28 09:43:46 ait sshd[3535688]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 220.250.41.11
description:
Jan 28 09:44:05 ait sshd[3535771]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=220.250.41.11


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.115.208
description:
Jan 28 09:44:26 ait sshd[3535840]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.115.208 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.115.208
description:
Jan 28 09:44:26 ait sshd[3535840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.115.208


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-28 09:44:35 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:61859: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 87.120.114.184
domain: ait.edu.gh
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:6.65||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.239.58.7
description:
[2025-01-28 09:43:58 +0100] info [webmaild] 37.239.58.7 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.250.41.11
description:
Jan 28 09:44:05 ait sshd[3535771]: pam_imunify(sshd:auth): [IM360_RBL] The IP 220.250.41.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.157.124.84
description:
2025-01-28 09:45:06 dovecot_login authenticator failed for ([219.157.124.84]) [219.157.124.84]:56448: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.40.18.220
description:
2025-01-28 09:45:14 dovecot_plain authenticator failed for ([179.40.18.220]) [179.40.18.220]:36635: 535 Incorrect authentication data (set_id=ads19b00188y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-28 09:44:46 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:21999: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
description:
Jan 28 09:44:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
description:
Jan 28 09:45:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 09:45:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.40.18.220
description:
Jan 28 09:45:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.40.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
description:
2025-01-28 09:44:52 dovecot_login authenticator failed for ([14.139.107.146]) [14.139.107.146]:43120: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.157.124.84
description:
Jan 28 09:45:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.157.124.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
description:
2025-01-28 09:45:04 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:58112: 535 Incorrect authentication data (set_id=ads19b00188y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.94.132.3
description:
[2025-01-28 09:45:26 +0100] info [webmaild] 138.94.132.3 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.219.112.190
description:
Jan 28 09:45:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.219.112.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-28 09:46:05 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:10648: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 95.168.173.174
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:09-46.95.168.173.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 28 09:45:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-28 09:45:51 dovecot_login authenticator failed for ([102.53.15.18]) [102.53.15.18]:40981: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.15.84.229
description:
Jan 28 09:46:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.15.84.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.217.1.27
description:
2025-01-28 09:46:28 dovecot_plain authenticator failed for static-193-217-1-27.cust.tele2.lt [193.217.1.27]:54162: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.207.152.163
description:
Jan 28 09:46:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.207.152.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.129.245.249
description:
2025-01-28 09:46:08 dovecot_plain authenticator failed for ([123.129.245.249]) [123.129.245.249]:45132: 535 Incorrect authentication data (set_id=abs3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.217.1.27
description:
Jan 28 09:46:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.217.1.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 28 09:46:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.219.112.190
description:
2025-01-28 09:45:47 dovecot_plain authenticator failed for ([60.219.112.190]) [60.219.112.190]:32810: 535 Incorrect authentication data (set_id=abs3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.129.245.249
description:
Jan 28 09:46:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.129.245.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-28 09:46:39 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:36192: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.207.152.163
description:
2025-01-28 09:46:45 dovecot_plain authenticator failed for ([102.207.152.163]) [102.207.152.163]:47937: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 28 09:46:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-28 09:46:50 dovecot_login authenticator failed for net-2-32-137-250.cust.vodafonedsl.it (net-2-32-137-250.cust.dsl.teletu.it) [2.32.137.250]:60636: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.134.96.117
description:
Jan 28 09:46:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.134.96.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.134.96.117
description:
2025-01-28 09:46:56 dovecot_plain authenticator failed for ([207.134.96.117]) [207.134.96.117]:45405: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-28 09:48:39 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:42226: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.31.12.187
description:
2025-01-28 09:48:06 dovecot_login authenticator failed for (static.vnpt.vn) [123.31.12.187]:59590: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 28 09:48:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 28 09:48:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-28 09:48:38 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (undlense) [2.139.88.148]:56946: 535 Incorrect authentication data (set_id=eng19b00195y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.196.60.148
description:
Jan 28 09:48:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.196.60.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 185.87.21.158
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:09-48.185.87.21.158||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.53.56
description:
Jan 28 09:48:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.53.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.53.56
description:
2025-01-28 09:48:39 dovecot_login authenticator failed for ([113.193.53.56]) [113.193.53.56]:33798: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.31.12.187
description:
Jan 28 09:48:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.31.12.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 28 09:48:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
description:
2025-01-28 09:48:22 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:57600: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 139.59.5.157
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:09-48.139.59.5.157||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.196.60.148
description:
2025-01-28 09:48:27 dovecot_plain authenticator failed for (repropar) [156.196.60.148]:47298: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-28 09:48:49 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:49791: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.204
description:
Jan 28 09:49:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.234.196.189
description:
Jan 28 09:49:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.234.196.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-28 09:49:37 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (wingery) [81.225.30.107]:51429: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.8.65
description:
2025-01-28 09:48:53 dovecot_login authenticator failed for (mail.phongphucorp.com) [14.161.8.65]:55031: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.192.47.43
description:
Jan 28 09:49:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.192.47.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.192.47.43
description:
2025-01-28 09:49:14 dovecot_plain authenticator failed for ([117.192.47.43]) [117.192.47.43]:47816: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 28 09:48:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 28 09:48:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.204
description:
2025-01-28 09:49:02 dovecot_login authenticator failed for ([111.61.176.204]) [111.61.176.204]:17490: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 160.238.132.158
description:
[2025-01-28 09:49:26 +0100] info [webmaild] 160.238.132.158 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 28 09:49:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-28 09:48:57 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:44420: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.63.228.29
description:
[2025-01-28 09:49:28 +0100] info [webmaild] 187.63.228.29 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.234.196.189
description:
2025-01-28 09:49:28 dovecot_plain authenticator failed for ([120.234.196.189]) [120.234.196.189]:56328: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.8.65
description:
Jan 28 09:48:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.8.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.181.133.153
description:
Jan 28 09:49:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.181.133.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.250.152.88
description:
Jan 28 09:50:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.250.152.88 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 200.105.141.150
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-50.200.105.141.150


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.181.133.153
description:
2025-01-28 09:49:58 dovecot_plain authenticator failed for ([179.181.135.1]) [179.181.133.153]:41895: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 09:50:18 ait sshd[3538519]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
description:
Jan 28 09:50:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Jan 28 09:50:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.15.83.69
description:
[2025-01-28 09:50:30 +0100] info [webmaild] 197.15.83.69 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-01-28 09:50:30 dovecot_plain authenticator failed for ([39.165.236.12]) [39.165.236.12]:44586: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.78.1.149
description:
Jan 28 09:50:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.78.1.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.1.149
description:
2025-01-28 09:50:38 dovecot_login authenticator failed for ([112.78.1.149]) [112.78.1.149]:45568: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.53.203
description:
[2025-01-28 09:50:21 +0100] info [webmaild] 177.129.53.203 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-01-28 09:50:22 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:2315: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.165.92.25
description:
[2025-01-28 09:50:27 +0100] info [webmaild] 103.165.92.25 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.250.152.88
description:
2025-01-28 09:50:33 dovecot_login authenticator failed for (170.250.152.88.hwccustomers.com) [170.250.152.88]:59798: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 09:50:18 ait sshd[3538519]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200  user=ftp


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.172.79.198
description:
Jan 28 09:50:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.172.79.198 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.28.217.86
description:
[2025-01-28 09:51:06 +0100] info [webmaild] 189.28.217.86 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.178.117.221
description:
[2025-01-28 09:51:02 +0100] info [webmaild] 186.178.117.221 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 28 09:51:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.207.134
description:
Jan 28 09:50:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.207.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.244.39
description:
Jan 28 09:51:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.244.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.72.244.39
description:
2025-01-28 09:51:02 dovecot_plain authenticator failed for 39.244.72.148.host.secureserver.net [148.72.244.39]:45794: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-28 09:51:29 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (sherbioner) [81.225.30.107]:36607: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
description:
2025-01-28 09:50:53 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:55438: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.116.164.225
description:
[2025-01-28 09:50:54 +0100] info [webmaild] 176.116.164.225 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.133.4
description:
Jan 28 09:51:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.133.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.4
description:
2025-01-28 09:51:32 dovecot_plain authenticator failed for (gables) [65.20.133.4]:44955: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.207.134
description:
2025-01-28 09:50:51 dovecot_plain authenticator failed for ([221.2.207.134]) [221.2.207.134]:39173: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.225.53.149
description:
2025-01-28 09:52:07 dovecot_plain authenticator failed for ([173.225.53.149]) [173.225.53.149]:55359: 535 Incorrect authentication data (set_id=jessica1234)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 09:52:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-28 09:52:41 dovecot_login authenticator failed for ([103.55.89.5]) [116.75.218.103]:41160: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.219.42.17
description:
[2025-01-28 09:52:43 +0100] info [webmaild] 102.219.42.17 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.207.22.124
description:
2025-01-28 09:52:04 dovecot_login authenticator failed for ([94.207.22.124]) [94.207.22.124]:60267: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 28 09:52:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 09:52:40 ait sshd[3539364]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.233.140.250
description:
Jan 28 09:52:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.233.140.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.157.53.204
description:
[2025-01-28 09:52:07 +0100] info [webmaild] 177.157.53.204 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-28 09:52:32 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:56067: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.234.97.249
description:
[2025-01-28 09:52:12 +0100] info [webmaild] 45.234.97.249 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 09:52:40 ait sshd[3539364]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.201.140.227
description:
Jan 28 09:51:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.201.140.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.201.140.227
description:
2025-01-28 09:51:57 dovecot_plain authenticator failed for ([45.201.140.227]) [45.201.140.227]:16256: 535 Incorrect authentication data (set_id=jessica1234@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.159
description:
Jan 28 09:52:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.159
description:
2025-01-28 09:52:18 dovecot_login authenticator failed for p7001160-ipoefx.ipoe.ocn.ne.jp [118.3.227.159]:60156: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 28 09:52:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.233.140.250
description:
2025-01-28 09:52:44 dovecot_login authenticator failed for ([181.233.140.250]) [181.233.140.250]:39651: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.171.127.190
description:
Jan 28 09:52:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.171.127.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 28 09:52:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-28 09:52:27 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:44058: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.207.22.124
description:
Jan 28 09:52:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.207.22.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.225.53.149
description:
Jan 28 09:52:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.225.53.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 28 09:52:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-28 09:52:17 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:41168: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-28 09:52:15 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:60661: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 28 09:52:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.79.179
description:
Jan 28 09:52:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.79.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.215.236.96
description:
2025-01-28 09:53:27 dovecot_plain authenticator failed for ip85-215-236-96.pbiaas.com [85.215.236.96]:51482: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.195.67.82
description:
Jan 28 09:53:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.195.67.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.195.67.82
description:
2025-01-28 09:53:42 dovecot_plain authenticator failed for ([200.195.67.82]) [200.195.67.82]:38124: 535 Incorrect authentication data (set_id=agbozume1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.157.148
description:
[2025-01-28 09:52:58 +0100] info [webmaild] 45.65.157.148 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 8.218.183.222
description:
Jan 28 09:53:12 ait sshd[3539471]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=8.218.183.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.215.236.96
description:
Jan 28 09:53:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.215.236.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.223
description:
2025-01-28 09:53:27 dovecot_plain authenticator failed for 110-25-105-223.adsl.fetnet.net [110.25.105.223]:58606: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-28 09:52:53 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:47530: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.192.79.179
description:
2025-01-28 09:52:55 dovecot_login authenticator failed for (pppoe-179.79.192.181.in-addr.arpa) [181.192.79.179]:56136: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.105.223
description:
Jan 28 09:53:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.105.223 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.202.151
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:09-53.157.245.202.151


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.207.248.5
description:
2025-01-28 09:55:23 dovecot_login authenticator failed for (mamanguape.static.gvt.net.br) [177.207.248.5]:33317: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.207.248.5
description:
Jan 28 09:55:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.207.248.5 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.222.189.226
description:
[2025-01-28 09:55:30 +0100] info [webmaild] 179.222.189.226 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.124.241.142
description:
Jan 28 09:55:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.124.241.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.124.241.142
description:
2025-01-28 09:55:38 dovecot_login authenticator failed for ([116.124.241.142]) [116.124.241.142]:45538: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 09:55:08 ait sshd[3540821]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 09:55:08 ait sshd[3540821]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.59.144
description:
2025-01-28 09:56:33 dovecot_plain authenticator failed for ([222.116.59.144]) [222.116.59.144]:43159: 535 Incorrect authentication data (set_id=ads20b00294y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.215.254.115
description:
Jan 28 09:55:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.215.254.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-28 09:55:54 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (pasis) [217.215.254.115]:39534: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Jan 28 09:55:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Jan 28 09:56:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.54.87.122
description:
Jan 28 09:56:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.54.87.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-01-28 09:56:22 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:33896: 535 Incorrect authentication data (set_id=ads20b00294y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.234.154
description:
Jan 28 09:56:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.234.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.116.59.144
description:
Jan 28 09:56:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.116.59.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.200.107
description:
2025-01-28 09:56:43 dovecot_plain authenticator failed for ([196.46.200.107]) [196.46.200.107]:32949: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-01-28 09:55:59 dovecot_plain authenticator failed for ([116.114.94.242]) [116.114.94.242]:42766: 535 Incorrect authentication data (set_id=ads21a00028y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.234.154
description:
2025-01-28 09:56:26 dovecot_plain authenticator failed for ([183.167.234.154]) [183.167.234.154]:49054: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.134.126.162
description:
Jan 28 09:56:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.134.126.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.86.250.188
description:
[2025-01-28 09:56:24 +0100] info [webmaild] 187.86.250.188 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.87.122
description:
2025-01-28 09:56:24 dovecot_plain authenticator failed for ([2.54.87.122]) [2.54.87.122]:45418: 535 Incorrect authentication data (set_id=ads21a00028y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.134.126.162
description:
2025-01-28 09:56:37 dovecot_plain authenticator failed for c-73-134-126-162.hsd1.md.comcast.net [73.134.126.162]:1503: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.200.107
description:
Jan 28 09:56:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.200.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77316794
name: IM360 WAF: Block request to known infected file
abuser: 45.148.10.71
domain: a-rapp.ait-edu.us
description:
IM360 WAF: Block request to known infected file||RSV:6.65||T:APACHE||MVN:REQUEST_COOKIES:80||MV:decode||Tracked:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.33.96.3
description:
Jan 28 09:56:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.33.96.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.33.96.3
description:
2025-01-28 09:56:57 dovecot_plain authenticator failed for ([14.33.96.3]) [14.33.96.3]:45277: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.35.237.38
description:
2025-01-28 09:58:19 dovecot_plain authenticator failed for ([183.105.138.168]) [211.35.237.38]:35179: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 09:58:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.215.211.223
description:
Jan 28 09:57:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.215.211.223 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.215.211.223
description:
2025-01-28 09:57:54 dovecot_plain authenticator failed for ([114.215.211.223]) [114.215.211.223]:51218: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 09:58:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.35.237.38
description:
Jan 28 09:58:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.35.237.38 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.23.210.188
description:
2025-01-28 09:59:16 dovecot_plain authenticator failed for (lecele) [89.23.210.188]:33089: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.23.210.188
description:
Jan 28 09:59:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.23.210.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 28 10:00:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-28 10:00:41 dovecot_plain authenticator failed for (dulavelly) [65.20.183.209]:42694: 535 Incorrect authentication data (set_id=eng38b22452y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 10:01:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.58.23
description:
[2025-01-28 10:01:07 +0100] info [webmaild] 143.0.58.23 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.217.240.147
description:
[2025-01-28 10:01:08 +0100] info [webmaild] 102.217.240.147 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 10:01:18 dovecot_plain authenticator failed for (feroxothne) [81.211.77.58]:24546: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 10:01:23 ait sshd[3543730]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 10:01:23 ait sshd[3543730]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 10:01:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:01:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.24.91.77
description:
[2025-01-28 10:01:48 +0100] info [webmaild] 191.24.91.77 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.53.212.75
description:
[2025-01-28 10:01:51 +0100] info [webmaild] 177.53.212.75 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.205.114.45
description:
[2025-01-28 10:02:16 +0100] info [webmaild] 37.205.114.45 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.245.37
description:
2025-01-28 10:02:22 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:39618: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 10:02:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 28 10:02:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-28 10:02:37 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:6416: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.53
description:
2025-01-28 10:02:19 dovecot_plain authenticator failed for ([65.20.251.53]) [65.20.251.53]:56784: 535 Incorrect authentication data (set_id=nyarko@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 10:02:28 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt [87.103.126.54]:45246: 535 Incorrect authentication data (set_id=nyarko)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 28 10:02:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.28.1.31
description:
[2025-01-28 10:02:44 +0100] info [webmaild] 37.28.1.31 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:01:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 146.158.68.39
description:
[2025-01-28 10:02:02 +0100] info [webmaild] 146.158.68.39 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.127.177.194
description:
Jan 28 10:02:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.127.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.251.53
description:
Jan 28 10:02:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.251.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.245.37
description:
Jan 28 10:02:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.245.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.127.177.194
description:
2025-01-28 10:02:21 dovecot_login authenticator failed for static-50-127-177-194.chtn.wv.frontiernet.net [50.127.177.194]:53962: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-28 10:02:36 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:44486: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.140.104.75
description:
[2025-01-28 10:02:56 +0100] info [webmaild] 177.140.104.75 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.48.142.81
description:
[2025-01-28 10:03:53 +0100] info [webmaild] 189.48.142.81 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.96.185.231
description:
[2025-01-28 10:03:57 +0100] info [webmaild] 179.96.185.231 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 10:04:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.128.174.209
description:
[2025-01-28 10:04:23 +0100] info [webmaild] 186.128.174.209 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.150.206.114
description:
[2025-01-28 10:04:31 +0100] info [webmaild] 170.150.206.114 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.207.112.45
description:
Jan 28 10:05:32 ait sshd[3545580]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.207.112.45


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.207.112.45
description:
Jan 28 10:05:32 ait sshd[3545580]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.207.112.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 28 10:05:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-28 10:05:36 dovecot_plain authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:51204: 535 Incorrect authentication data (set_id=7606e1dcc1da@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.50.233.202
description:
[2025-01-28 10:05:50 +0100] info [webmaild] 189.50.233.202 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:04:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.2.153.49
description:
Jan 28 10:05:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.2.153.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.2.153.49
description:
2025-01-28 10:05:57 dovecot_plain authenticator failed for ([221.2.153.49]) [221.2.153.49]:44830: 535 Incorrect authentication data (set_id=7606e1dcc1da)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.166.68.184
description:
2025-01-28 10:07:44 dovecot_plain authenticator failed for ([5.166.68.184]) [5.166.68.184]:51472: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.171.31.6
description:
[2025-01-28 10:07:05 +0100] info [webmaild] 45.171.31.6 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.231.185.228
description:
2025-01-28 10:07:35 dovecot_plain authenticator failed for ([212.231.185.228]) [212.231.185.228]:59497: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.47
description:
2025-01-28 10:07:40 dovecot_plain authenticator failed for (inaill) [65.20.193.47]:48185: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.74.236.221
description:
[2025-01-28 10:07:19 +0100] info [webmaild] 177.74.236.221 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.166.68.184
description:
Jan 28 10:07:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.166.68.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.234.151.178
description:
Jan 28 10:07:20 ait sshd[3546273]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.234.151.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.234.151.178
description:
Jan 28 10:07:20 ait sshd[3546273]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.234.151.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.231.185.228
description:
Jan 28 10:07:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.231.185.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.47
description:
Jan 28 10:07:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.34.57.78
description:
Jan 28 10:08:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.34.57.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.138.132.109
description:
Jan 28 10:08:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.138.132.109 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 116.122.157.193
description:
Jan 28 10:08:42 ait sshd[3546634]: Invalid user universitypublishing from 116.122.157.193 port 35454


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 10:08:42 ait sshd[3546634]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-28 10:08:19 dovecot_plain authenticator failed for ([140.246.50.122]) [203.34.57.78]:57472: 535 Incorrect authentication data (set_id=eng18b00213y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.79.20.9
description:
Jan 28 10:08:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.79.20.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
description:
2025-01-28 10:08:27 dovecot_plain authenticator failed for h77-94-125-250.static.bashtel.ru [77.94.125.250]:60011: 535 Incorrect authentication data (set_id=eng18b00213y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Jan 28 10:08:28 ait sshd[3546610]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.79.20.9
description:
2025-01-28 10:08:27 dovecot_plain authenticator failed for ([95.79.20.9]) [95.79.20.9]:60932: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Jan 28 10:08:28 ait sshd[3546610]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.138.132.109
description:
2025-01-28 10:08:39 dovecot_plain authenticator failed for ([36.138.132.109]) [36.138.132.109]:49342: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 10:08:42 ait sshd[3546634]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.94.125.250
description:
Jan 28 10:08:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.94.125.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.234.151.178
description:
Jan 28 10:11:02 ait sshd[3547778]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.234.151.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.234.151.178
description:
Jan 28 10:11:02 ait sshd[3547778]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.234.151.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 28 10:11:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-28 10:11:50 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (dioliff) [81.237.110.29]:53642: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 28 10:12:37 ait sshd[3548346]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=gvu


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.234.151.178
description:
Jan 28 10:12:39 ait sshd[3548350]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.234.151.178


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 28 10:12:37 ait sshd[3548346]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 131.100.89.79
description:
[2025-01-28 10:12:41 +0100] info [webmaild] 131.100.89.79 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.177.145.123
description:
[2025-01-28 10:12:40 +0100] info [webmaild] 79.177.145.123 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.46.110.194
description:
Jan 28 10:12:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.46.110.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.110.194
description:
2025-01-28 10:12:44 dovecot_login authenticator failed for host194.sub-63-46-110.myvzw.com [63.46.110.194]:32968: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.234.151.178
description:
Jan 28 10:12:41 ait sshd[3548350]: Failed password for invalid user kavita from 103.234.151.178 port 46782 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.234.151.178
description:
Jan 28 10:12:39 ait sshd[3548350]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.234.151.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.98.113
description:
2025-01-28 10:12:56 dovecot_login authenticator failed for ([91.74.98.113]) [91.74.98.113]:55841: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-01-28 10:13:13 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:30880: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.174.248
description:
2025-01-28 10:13:29 dovecot_plain authenticator failed for broadband-77-37-174-248.ip.moscow.rt.ru [77.37.174.248]:55246: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.112.154.174
description:
Jan 28 10:13:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.112.154.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.112.154.174
description:
2025-01-28 10:13:39 dovecot_plain authenticator failed for ([203.112.154.174]) [203.112.154.174]:37892: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.138.66.223
description:
[2025-01-28 10:12:55 +0100] info [webmaild] 200.138.66.223 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.98.113
description:
Jan 28 10:12:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.98.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.97.209
description:
2025-01-28 10:12:55 dovecot_plain authenticator failed for ([116.90.97.209]) [116.90.97.209]:49845: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.218.205
description:
[2025-01-28 10:13:47 +0100] info [webmaild] 45.185.218.205 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Jan 28 10:13:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.174.248
description:
Jan 28 10:13:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.174.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.104.17.47
description:
[2025-01-28 10:13:43 +0100] info [webmaild] 177.104.17.47 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.97.209
description:
Jan 28 10:12:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 10:13:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.86.45
description:
[2025-01-28 10:13:52 +0100] info [webmaild] 213.230.86.45 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.89.99
description:
2025-01-28 10:14:08 dovecot_plain authenticator failed for ([177.174.89.105]) [177.174.89.99]:55328: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.157.14
description:
[2025-01-28 10:14:16 +0100] info [webmaild] 168.197.157.14 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.240.37.74
description:
Jan 28 10:14:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.240.37.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.255.52.54
description:
[2025-01-28 10:14:32 +0100] info [webmaild] 143.255.52.54 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.89.99
description:
Jan 28 10:14:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.89.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.240.37.74
description:
2025-01-28 10:14:19 dovecot_plain authenticator failed for ([1.71.191.42]) [61.240.37.74]:16338: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:15:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.139.189
description:
Jan 28 10:14:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.139.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
description:
Jan 28 10:15:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.129.223.132
description:
[2025-01-28 10:15:29 +0100] info [webmaild] 105.129.223.132 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 78.163.140.142
description:
[2025-01-28 10:15:39 +0100] info [webmaild] 78.163.140.142 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.10
description:
Jan 28 10:15:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
description:
2025-01-28 10:15:17 dovecot_plain authenticator failed for ([27.223.98.117]) [27.223.98.117]:58736: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:15:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.10
description:
2025-01-28 10:15:49 dovecot_login authenticator failed for ([104.241.238.10]) [104.241.238.10]:48605: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.139.189
description:
2025-01-28 10:14:55 dovecot_plain authenticator failed for ([180.188.139.189]) [180.188.139.189]:51198: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 28 10:15:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-28 10:15:37 dovecot_login authenticator failed for (159.14.132.112.adsl-pool.ah.cnuninet.net) [112.132.14.159]:37178: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.89.232.138
description:
Jan 28 10:16:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.89.232.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 194.246.91.53
description:
[2025-01-28 10:16:03 +0100] info [webmaild] 194.246.91.53 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.89.232.138
description:
2025-01-28 10:16:06 dovecot_plain authenticator failed for ([159.89.232.138]) [159.89.232.138]:49620: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 28 10:16:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.5
description:
Jan 28 10:16:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.5 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Jan 28 10:16:35 ait sshd[3550362]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.218.29.245
description:
[2025-01-28 10:15:58 +0100] info [webmaild] 186.218.29.245 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-28 10:16:15 dovecot_plain authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com (peravily) [131.106.85.205]:40628: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.5
description:
2025-01-28 10:16:17 dovecot_plain authenticator failed for 111-70-32-5.emome-ip.hinet.net [111.70.32.5]:47064: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Jan 28 10:16:34 ait sshd[3550362]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.110.242.193
description:
[2025-01-28 10:17:27 +0100] info [webmaild] 152.110.242.193 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-28 10:17:18 dovecot_plain authenticator failed for (brade) [65.20.183.209]:48584: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 28 10:17:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.237.92.22
description:
[2025-01-28 10:18:42 +0100] info [webmaild] 45.237.92.22 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.242.20.173
description:
[2025-01-28 10:18:15 +0100] info [webmaild] 213.242.20.173 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:18:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.44.246.82
description:
2025-01-28 10:18:57 dovecot_login authenticator failed for ([12.44.246.82]) [12.44.246.82]:44625: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 28 10:19:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-28 10:19:07 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:22086: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 10:19:30 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (mulbet) [91.56.31.108]:59458: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.44.246.82
description:
Jan 28 10:18:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.44.246.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 28 10:19:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-28 10:19:49 dovecot_plain authenticator failed for (tazing) [93.159.152.6]:49496: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 10:19:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Jan 28 10:20:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 10:20:22 ait sshd[3551743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:20:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-01-28 10:20:20 dovecot_plain authenticator failed for (glecuner) [65.20.155.91]:54588: 535 Incorrect authentication data (set_id=ads22a00155y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 10:20:22 ait sshd[3551746]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.22.205
description:
2025-01-28 10:20:50 dovecot_plain authenticator failed for ([211.43.22.205]) [211.43.22.205]:59414: 535 Incorrect authentication data (set_id=ads17a00060y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 10:20:22 ait sshd[3551743]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 10:20:22 ait sshd[3551746]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.43.22.205
description:
Jan 28 10:20:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.43.22.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-28 10:21:07 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:50464: 535 Incorrect authentication data (set_id=ads17a00060y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 28 10:21:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 28 10:22:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-28 10:22:24 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:42046: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 28 10:22:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.224.198
description:
2025-01-28 10:22:44 dovecot_plain authenticator failed for (hostmact) [65.20.224.198]:52031: 535 Incorrect authentication data (set_id=eng17b00218y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-28 10:22:03 dovecot_plain authenticator failed for (adusly) [164.92.243.206]:43526: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:22:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-28 10:22:40 dovecot_plain authenticator failed for (noused) [37.224.119.19]:47490: 535 Incorrect authentication data (set_id=eng17b00218y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.224.198
description:
Jan 28 10:22:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.224.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.231.242
description:
Jan 28 10:23:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.231.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.231.242
description:
2025-01-28 10:23:28 dovecot_plain authenticator failed for ([124.115.231.242]) [124.115.231.242]:39305: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 152.250.220.57
description:
[2025-01-28 10:23:37 +0100] info [webmaild] 152.250.220.57 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:23:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.176.249.35
description:
Jan 28 10:23:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.176.249.35 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.176.249.35
description:
2025-01-28 10:23:43 dovecot_plain authenticator failed for ([112.176.249.35]) [112.176.249.35]:58424: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 28 10:23:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-28 10:23:35 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com (unwoolangm) [131.106.31.52]:49436: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:24:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 10:24:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.113.155.201
description:
[2025-01-28 10:24:30 +0100] info [webmaild] 196.113.155.201 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 10:24:32 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (synaur) [87.103.126.54]:59133: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:24:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 10:24:01 ait sshd[3553029]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 10:24:01 ait sshd[3553029]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.108.123.47
description:
[2025-01-28 10:24:15 +0100] info [webmaild] 190.108.123.47 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.195.236.21
description:
[2025-01-28 10:25:35 +0100] info [webmaild] 186.195.236.21 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.233.45.58
description:
[2025-01-28 10:25:45 +0100] info [webmaild] 186.233.45.58 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.162.144
description:
[2025-01-28 10:25:07 +0100] info [webmaild] 179.125.162.144 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.232.198.129
description:
[2025-01-28 10:25:22 +0100] info [webmaild] 168.232.198.129 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:26:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.207.67.153
description:
[2025-01-28 10:26:12 +0100] info [webmaild] 94.207.67.153 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.110.10.192
description:
Jan 28 10:26:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.110.10.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.110.10.192
description:
2025-01-28 10:26:23 dovecot_plain authenticator failed for (macks) [2.110.10.192]:59828: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.153.155.245
description:
[2025-01-28 10:27:25 +0100] info [webmaild] 103.153.155.245 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.20.117.0
description:
[2025-01-28 10:27:28 +0100] info [webmaild] 157.20.117.0 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Jan 28 10:27:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-01-28 10:27:15 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:35901: 535 Incorrect authentication data (set_id=ads89a99079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.41.137
description:
Jan 28 10:27:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.41.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.41.137
description:
2025-01-28 10:27:24 dovecot_plain authenticator failed for ([196.190.43.138]) [196.190.41.137]:14242: 535 Incorrect authentication data (set_id=ads89a99079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-01-28 10:28:33 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:57024: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.173.205.27
description:
[2025-01-28 10:27:56 +0100] info [webmaild] 185.173.205.27 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 28 10:28:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-28 10:28:02 dovecot_plain authenticator failed for mail.schindler-statik.at (zoosperous) [80.120.186.246]:50328: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.249.167.244
description:
[2025-01-28 10:28:04 +0100] info [webmaild] 85.249.167.244 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-28 10:28:15 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:58474: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Jan 28 10:28:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 103.127.134.129
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-28.103.127.134.129


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 10:27:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 10:27:58 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (sportishes) [91.56.31.108]:59180: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 28 10:28:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.44.130.63
description:
[2025-01-28 10:29:20 +0100] info [webmaild] 181.44.130.63 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.200.188.170
description:
Jan 28 10:29:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.200.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.149.226
description:
2025-01-28 10:29:20 dovecot_login authenticator failed for 226.149.48.116.static.netvigator.com [116.48.149.226]:52998: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.244.126.105
description:
Jan 28 10:29:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.244.126.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 10:29:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.188.170
description:
2025-01-28 10:29:33 dovecot_login authenticator failed for ([87.200.188.170]) [87.200.188.170]:51588: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.244.126.105
description:
2025-01-28 10:29:40 dovecot_plain authenticator failed for 92-244-126-105.kievnet.com.ua (codoroanx) [92.244.126.105]:39483: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.149.226
description:
Jan 28 10:29:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.149.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.246.190.142
description:
[2025-01-28 10:29:18 +0100] info [webmaild] 170.246.190.142 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 10:30:08 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (yarluidae) [91.56.31.108]:61648: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.31.113
description:
47.128.31.113 - - [28/Jan/2025:10:29:59 +0100] "GET /wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css?ver=5.15.3 HTTP/2.0" 200 1461 elibrary.ait-edu.us "https://elibrary.ait-edu.us/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=24581316" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.31.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 10:30:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.129.171
description:
Jan 28 10:30:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.129.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.129.171
description:
2025-01-28 10:30:44 dovecot_plain authenticator failed for (unhal) [65.20.129.171]:47835: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.99.253.248
description:
Jan 28 10:30:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.99.253.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.99.253.248
description:
2025-01-28 10:30:08 dovecot_plain authenticator failed for host-37-99-253-248.geny.it (weeroy) [37.99.253.248]:57054: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.0.254.135
description:
[2025-01-28 10:30:22 +0100] info [webmaild] 143.0.254.135 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.250.238.189
description:
Jan 28 10:31:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.250.238.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 28 10:31:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.250.238.189
description:
2025-01-28 10:31:25 dovecot_plain authenticator failed for c83-250-238-189.bredband.tele2.se (amperfort) [83.250.238.189]:55276: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-28 10:31:26 dovecot_plain authenticator failed for (reaming) [154.144.243.93]:51224: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.237.10
description:
Jan 28 10:31:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.237.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.237.10
description:
2025-01-28 10:31:30 dovecot_plain authenticator failed for ([94.204.237.10]) [94.204.237.10]:59412: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 28 10:31:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-28 10:31:47 dovecot_plain authenticator failed for (nensesity) [91.234.132.226]:57345: 535 Incorrect authentication data (set_id=eng20a00115y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.33.247.159
description:
2025-01-28 10:32:11 dovecot_plain authenticator failed for 92-33-247-159.customers.ownit.se (setrossite) [92.33.247.159]:41190: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.200.80.226
description:
Jan 28 10:32:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.200.80.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 10:32:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 10:31:57 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (noingthy) [87.103.126.54]:65325: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-28 10:32:03 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:42892: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.33.247.159
description:
Jan 28 10:32:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.33.247.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.80.226
description:
2025-01-28 10:32:15 dovecot_login authenticator failed for ([94.200.80.226]) [94.200.80.226]:43668: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.177.194
description:
Jan 28 10:31:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.177.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 10:31:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.177.194
description:
2025-01-28 10:31:54 dovecot_plain authenticator failed for ([124.115.177.194]) [124.115.177.194]:48749: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 28 10:32:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-28 10:33:44 dovecot_login authenticator failed for (www.safecleen.com) [58.49.113.138]:15814: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.224.119.19
description:
Jan 28 10:32:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.224.119.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.224.119.19
description:
2025-01-28 10:32:53 dovecot_plain authenticator failed for (ocifor) [37.224.119.19]:36394: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.34.26
description:
2025-01-28 10:33:25 dovecot_login authenticator failed for ([60.174.34.26]) [60.174.34.26]:33039: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
description:
2025-01-28 10:33:35 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.138]:42632: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
description:
Jan 28 10:33:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.34.26
description:
Jan 28 10:33:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.34.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.138
description:
Jan 28 10:33:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 28 10:33:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.181.195.26
description:
Jan 28 10:33:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.181.195.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.195.26
description:
2025-01-28 10:33:11 dovecot_login authenticator failed for (5.181.195.26.customer.sinergiatel.it) [5.181.195.26]:48196: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.159.217.71
description:
Jan 28 10:33:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.159.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.159.217.71
description:
2025-01-28 10:33:16 dovecot_plain authenticator failed for 195-159-217-71.customer.powertech.no (sozooness) [195.159.217.71]:58242: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 28 10:34:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-28 10:34:35 dovecot_plain authenticator failed for (umammut) [91.116.42.218]:44614: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.231.31.86
description:
2025-01-28 10:33:54 dovecot_plain authenticator failed for (brined) [62.231.31.86]:37979: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.93
description:
2025-01-28 10:34:03 dovecot_login authenticator failed for ([104.241.230.93]) [104.241.230.93]:39113: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 28 10:34:21 ait sshd[3557277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.104.199.27
description:
Jan 28 10:33:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.104.199.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.231.31.86
description:
Jan 28 10:33:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.231.31.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 28 10:34:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.104.199.27
description:
2025-01-28 10:33:54 dovecot_plain authenticator failed for ([120.24.83.156]) [223.104.199.27]:28706: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.71.199.46
description:
2025-01-28 10:34:05 dovecot_plain authenticator failed for ([120.71.199.46]) [120.71.199.46]:54571: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 28 10:34:21 ait sshd[3557277]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-28 10:34:26 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net (omatests) [81.16.170.117]:50000: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.192.19.188
description:
[2025-01-28 10:34:32 +0100] info [webmaild] 177.192.19.188 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.93
description:
Jan 28 10:34:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.71.199.46
description:
Jan 28 10:34:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.71.199.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.200.226.218
description:
Jan 28 10:35:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.200.226.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 28 10:35:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-28 10:35:47 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:39172: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.188.118.200
description:
[2025-01-28 10:36:49 +0100] info [webmaild] 177.188.118.200 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Jan 28 10:35:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 28 10:36:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-28 10:36:11 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:32978: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.253.220
description:
2025-01-28 10:36:23 dovecot_plain authenticator failed for (pelimpan) [65.20.253.220]:55042: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-28 10:36:32 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:50166: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.207.227.147
description:
[2025-01-28 10:36:10 +0100] info [webmaild] 196.207.227.147 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-28 10:36:40 dovecot_login authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:54795: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-28 10:36:21 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (sectagy) [81.225.30.107]:45201: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 79.120.66.46
description:
[2025-01-28 10:36:25 +0100] info [webmaild] 79.120.66.46 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.97.17.208
description:
Jan 28 10:35:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.97.17.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.113.91
description:
Jan 28 10:35:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.113.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.113.91
description:
2025-01-28 10:36:00 dovecot_login authenticator failed for ([175.206.113.91]) [175.206.113.91]:45010: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.243.93
description:
Jan 28 10:36:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.243.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
description:
Jan 28 10:36:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.224.89.112
description:
2025-01-28 10:36:11 dovecot_login authenticator failed for (112.89.224.159.triolan.net) [159.224.89.112]:54715: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 28 10:36:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-28 10:36:42 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:35760: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.196.62
description:
Jan 28 10:36:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.196.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 28 10:36:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.14.192.20
description:
Jan 28 10:36:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.14.192.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.14.192.20
description:
2025-01-28 10:36:05 dovecot_login authenticator failed for ([110.14.192.20]) [110.14.192.20]:42274: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
description:
Jan 28 10:36:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.253.220
description:
Jan 28 10:36:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.253.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-28 10:36:39 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:42208: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 28 10:36:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
description:
2025-01-28 10:35:54 dovecot_login authenticator failed for ([61.97.17.208]) [61.97.17.208]:51263: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 28 10:36:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-28 10:36:43 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:10431: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.200.226.218
description:
2025-01-28 10:35:52 dovecot_plain authenticator failed for 91-200-226-218.client.linkline.ru (tridal) [91.200.226.218]:49622: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-01-28 10:36:01 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:34402: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
description:
2025-01-28 10:36:05 dovecot_plain authenticator failed for (twing) [154.144.243.93]:56748: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
description:
2025-01-28 10:36:17 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:53664: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 28 10:36:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 28 10:36:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.243
description:
2025-01-28 10:36:54 dovecot_login authenticator failed for ([111.61.176.243]) [111.61.176.243]:38706: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 206.0.16.157
description:
[2025-01-28 10:37:22 +0100] info [webmaild] 206.0.16.157 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 95.220.146.240
description:
[2025-01-28 10:36:51 +0100] info [webmaild] 95.220.146.240 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.243
description:
Jan 28 10:36:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.84.107.245
description:
2025-01-28 10:37:10 dovecot_login authenticator failed for ([220.84.107.245]) [220.84.107.245]:45916: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.246.43
description:
2025-01-28 10:37:14 dovecot_login authenticator failed for ([220.178.246.43]) [220.178.246.43]:40976: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.59.2
description:
Jan 28 10:36:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.59.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.124.14.165
description:
[2025-01-28 10:37:10 +0100] info [webmaild] 177.124.14.165 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.84.107.245
description:
Jan 28 10:37:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.84.107.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.246.43
description:
Jan 28 10:37:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.246.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.162
description:
Jan 28 10:37:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.161.217.228
description:
2025-01-28 10:36:58 dovecot_login authenticator failed for (228.pool90-161-217.static.orange.es) [90.161.217.228]:49146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.59.2
description:
2025-01-28 10:37:01 dovecot_login authenticator failed for syn-074-062-059-002.biz.spectrum.com [74.62.59.2]:60086: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.11.106
description:
Jan 28 10:37:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.11.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.11.106
description:
2025-01-28 10:37:19 dovecot_login authenticator failed for (107.11.22.218.broad.static.hf.ah.cndata.com) [218.22.11.106]:42969: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.162
description:
2025-01-28 10:37:42 dovecot_login authenticator failed for p7001163-ipoefx.ipoe.ocn.ne.jp [118.3.227.162]:35994: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.196.62
description:
2025-01-28 10:36:50 dovecot_login authenticator failed for ([183.167.196.62]) [183.167.196.62]:38820: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.161.217.228
description:
Jan 28 10:36:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.161.217.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 28 10:38:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 28 10:38:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 28 10:38:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.251.60.128
description:
Jan 28 10:38:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.251.60.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.251.60.128
description:
2025-01-28 10:38:46 dovecot_login authenticator failed for (128.60.251.198.dynamic.vianetdsl.com) [198.251.60.128]:47229: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 28 10:38:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.96.100.99
description:
Jan 28 10:37:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.96.100.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 10:38:21 dovecot_plain authenticator failed for (ditarted) [46.30.161.197]:51266: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.210.74.19
description:
Jan 28 10:38:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.210.74.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:38:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-28 10:38:38 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:28030: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 10:38:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.226.165.254
description:
[2025-01-28 10:37:50 +0100] info [webmaild] 45.226.165.254 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-28 10:38:29 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:55651: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
description:
2025-01-28 10:38:44 dovecot_login authenticator failed for ([60.174.39.82]) [60.174.39.82]:52038: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.71.173.250
description:
Jan 28 10:38:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.71.173.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
description:
2025-01-28 10:38:45 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:44563: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 28 10:38:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 28 10:38:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.96.100.99
description:
2025-01-28 10:38:01 dovecot_login authenticator failed for ppp-171-96-100-99.revip8.asianet.co.th [171.96.100.99]:40362: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-28 10:38:02 dovecot_plain authenticator failed for (redisewres) [164.92.243.206]:36976: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.174.243
description:
Jan 28 10:38:02 ait sshd[3559069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-28 10:38:11 dovecot_plain authenticator failed for (aclepulip) [109.166.70.166]:52407: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-28 10:38:15 dovecot_plain authenticator failed for (grecces) [65.20.183.209]:59590: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.225.236
description:
2025-01-28 10:38:26 dovecot_login authenticator failed for 95-87-225-236.ip.btc-net.bg [95.87.225.236]:49214: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.210.74.19
description:
2025-01-28 10:38:29 dovecot_login authenticator failed for ([175.210.74.19]) [175.210.74.19]:50866: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.71.173.250
description:
2025-01-28 10:38:47 dovecot_login authenticator failed for ([14.97.143.225]) [182.71.173.250]:35488: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.42.100
description:
Jan 28 10:38:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.42.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 10:38:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.225.236
description:
Jan 28 10:38:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.225.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
description:
Jan 28 10:38:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-28 10:38:45 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (coadrame) [62.63.230.241]:43672: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 28 10:38:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.160.38.13
description:
Jan 28 10:38:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.160.38.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.67
description:
Jan 28 10:38:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
description:
2025-01-28 10:39:02 dovecot_login authenticator failed for ([222.120.176.6]) [222.120.176.6]:42056: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-28 10:39:06 dovecot_login authenticator failed for (134.227.160.222.adsl-pool.jlccptt.net.cn) [222.160.227.134]:36412: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.243.106.218
description:
2025-01-28 10:39:43 dovecot_plain authenticator failed for 218.106-243-81.adsl-dyn.isp.belgacom.be (aphamess) [81.243.106.218]:57244: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.38.13
description:
2025-01-28 10:38:59 dovecot_plain authenticator failed for 89-160-38-13.cust.bredband2.com [89.160.38.13]:45246: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 31.148.162.59
description:
[2025-01-28 10:39:14 +0100] info [webmaild] 31.148.162.59 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.120
description:
2025-01-28 10:39:17 dovecot_login authenticator failed for ([74.196.184.120]) [74.196.184.120]:55452: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-28 10:38:51 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:41044: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-28 10:39:13 dovecot_plain authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:54764: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.196.184.120
description:
Jan 28 10:39:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.196.184.120 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 85.140.119.249
description:
[2025-01-28 10:39:39 +0100] info [webmaild] 85.140.119.249 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-28 10:39:42 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:32956: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
description:
2025-01-28 10:38:53 dovecot_login authenticator failed for ([121.179.93.147]) [121.179.93.147]:44860: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-28 10:39:05 dovecot_login authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [103.109.44.163]:42380: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 28 10:39:37 ait sshd[3559636]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.243.106.218
description:
Jan 28 10:39:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.243.106.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
description:
Jan 28 10:38:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 28 10:39:03 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 28 10:39:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 28 10:39:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.34
description:
Jan 28 10:38:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.34
description:
2025-01-28 10:39:01 dovecot_login authenticator failed for (m121-202-152-34.smartone.com) [121.202.152.34]:1943: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.72
description:
Jan 28 10:39:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.74.230.193
description:
[2025-01-28 10:39:15 +0100] info [webmaild] 177.74.230.193 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.72
description:
2025-01-28 10:39:15 dovecot_login authenticator failed for (72.20.167.124.adsl-pool.sx.cn) [124.167.20.72]:53766: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.67
description:
2025-01-28 10:38:52 dovecot_login authenticator failed for ([111.61.176.67]) [111.61.176.67]:51900: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
description:
Jan 28 10:39:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 28 10:39:37 ait sshd[3559636]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 28 10:40:05 ait sshd[3560104]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 28 10:40:05 ait sshd[3560104]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.225.30.107
description:
2025-01-28 10:40:15 dovecot_plain authenticator failed for 81-225-30-107-no2380.tbcn.telia.com (foranes) [81.225.30.107]:35662: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 28 10:40:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.147.94
description:
2025-01-28 10:39:55 dovecot_login authenticator failed for ([80.227.147.94]) [80.227.147.94]:41151: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 28 10:40:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.92.243.206
description:
2025-01-28 10:40:39 dovecot_plain authenticator failed for (wrastergy) [164.92.243.206]:35196: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.135
description:
Jan 28 10:40:46 ait sshd[3560442]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.135


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 28 10:39:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.241.22
description:
2025-01-28 10:40:04 dovecot_login authenticator failed for (49.206.244.235.actcorp.in) [49.206.241.22]:65519: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 28 10:40:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.70.114.230
description:
Jan 28 10:40:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.70.114.230 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.76.222.116
description:
[2025-01-28 10:40:01 +0100] info [webmaild] 189.76.222.116 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-28 10:40:11 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:50453: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.70.114.230
description:
2025-01-28 10:40:16 dovecot_login authenticator failed for zdomainaccess.com [216.70.114.230]:49738: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.147.94
description:
Jan 28 10:39:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.147.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-28 10:40:36 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net (nisan) [109.67.154.24]:54042: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.92.243.206
description:
Jan 28 10:40:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.92.243.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.135
description:
Jan 28 10:40:46 ait sshd[3560442]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.149
description:
2025-01-28 10:40:09 dovecot_login authenticator failed for (m121-202-155-149.smartone.com) [121.202.155.149]:45511: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.225.30.107
description:
Jan 28 10:40:13 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.225.30.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-28 10:39:56 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:34649: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 217.107.115.203
description:
[2025-01-28 10:40:09 +0100] info [webmaild] 217.107.115.203 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-28 10:40:20 dovecot_login authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:57039: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.149
description:
Jan 28 10:40:07 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.206.241.22
description:
Jan 28 10:40:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.206.241.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-28 10:41:20 dovecot_login authenticator failed for (105.5-159-173.dynamic.clientes.euskaltel.es) [5.159.173.105]:56182: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.174.243
description:
Jan 28 10:41:28 ait sshd[3560635]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 28 10:41:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 124.29.239.111
description:
[2025-01-28 10:41:11 +0100] info [webmaild] 124.29.239.111 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 28 10:41:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.247
description:
2025-01-28 10:41:26 dovecot_login authenticator failed for ([104.241.234.247]) [104.241.234.247]:49230: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
description:
Jan 28 10:41:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
description:
Jan 28 10:41:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.109.20.192
description:
2025-01-28 10:41:35 dovecot_login authenticator failed for (ip-20-192.datautama.net.id) [112.109.20.192]:37089: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.35.218.58
description:
Jan 28 10:41:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.35.218.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.254.67
description:
Jan 28 10:41:48 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.254.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.218.58
description:
2025-01-28 10:41:41 dovecot_login authenticator failed for ([14.35.218.58]) [14.35.218.58]:56735: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.243.166.66
description:
Jan 28 10:41:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.243.166.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-28 10:41:44 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:41918: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
description:
2025-01-28 10:41:45 dovecot_login authenticator failed for ([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.247
description:
Jan 28 10:41:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
description:
2025-01-28 10:41:29 dovecot_login authenticator failed for (85-19-195-12.telia-isp.no) [85.19.195.12]:48430: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.154.14
description:
2025-01-28 10:41:30 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:60582: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.109.20.192
description:
Jan 28 10:41:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.109.20.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.254.67
description:
2025-01-28 10:41:50 dovecot_login authenticator failed for ([183.108.254.67]) [183.108.254.67]:51750: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.197.67.221
description:
[2025-01-28 10:42:11 +0100] info [webmaild] 168.197.67.221 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-28 10:42:11 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:59734: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.62
description:
Jan 28 10:42:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.28.237.90
description:
Jan 28 10:42:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.28.237.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.142.105.18
description:
2025-01-28 10:42:35 dovecot_plain authenticator failed for ([180.142.105.18]) [180.142.105.18]:41219: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.4.196.180
description:
2025-01-28 10:41:57 dovecot_login authenticator failed for 202-4-196-180.static.pccw-hkt.com [202.4.196.180]:58324: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.34.142
description:
2025-01-28 10:42:12 dovecot_login authenticator failed for ([119.206.34.142]) [119.206.34.142]:38348: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 28 10:41:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-28 10:41:59 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:39106: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.142.105.18
description:
Jan 28 10:42:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.142.105.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 28 10:42:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.225.239.115
description:
Jan 28 10:42:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.225.239.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.222.184.18
description:
Jan 28 10:42:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.222.184.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.135
description:
Jan 28 10:42:24 ait sshd[3561002]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.135 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.135
description:
Jan 28 10:42:24 ait sshd[3561002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.135


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.28.237.90
description:
2025-01-28 10:42:32 dovecot_plain authenticator failed for (187-50-193-126.customer.tdatabrasil.net.br) [201.28.237.90]:39890: 535 Incorrect authentication data (set_id=torgbor)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 28 10:41:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.4.196.180
description:
Jan 28 10:41:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.4.196.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.62
description:
2025-01-28 10:42:27 dovecot_login authenticator failed for ([111.61.176.62]) [111.61.176.62]:47010: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.34.142
description:
Jan 28 10:42:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.34.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 28 10:42:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.225.239.115
description:
2025-01-28 10:42:11 dovecot_plain authenticator failed for ([58.225.239.115]) [58.225.239.115]:37466: 535 Incorrect authentication data (set_id=torgbor@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.222.184.18
description:
2025-01-28 10:42:13 dovecot_login authenticator failed for ([58.222.184.18]) [58.222.184.18]:47108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-28 10:41:56 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:49743: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.149.132.246
description:
2025-01-28 10:42:19 dovecot_plain authenticator failed for c188-149-132-246.bredband.tele2.se (popatic) [188.149.132.246]:49526: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.149.132.246
description:
Jan 28 10:42:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.149.132.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-28 10:43:44 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:39832: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-28 10:42:51 dovecot_plain authenticator failed for ([200.141.225.73]) [200.149.54.14]:49406: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.224.164.194
description:
Jan 28 10:42:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.224.164.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-01-28 10:43:14 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:57566: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Jan 28 10:43:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 64.227.174.243
description:
Jan 28 10:43:07 ait sshd[3561284]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.227.174.243


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 64.227.174.243
description:
Jan 28 10:43:10 ait sshd[3561284]: Failed password for invalid user ubuntu from 64.227.174.243 port 45026 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 28 10:43:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.90.135
description:
Jan 28 10:43:43 ait sshd[3561534]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.255.90.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.224.164.194
description:
2025-01-28 10:42:55 dovecot_plain authenticator failed for ([122.224.164.194]) [122.224.164.194]:46301: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.255.90.135
description:
Jan 28 10:43:43 ait sshd[3561534]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.255.90.135  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-28 10:43:31 dovecot_login authenticator failed for ([39.165.183.70]) [39.165.183.70]:43638: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.164.246.53
description:
Jan 28 10:43:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.164.246.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.164.246.53
description:
2025-01-28 10:43:47 dovecot_plain authenticator failed for 53.246.164.109.static.wline.lns.sme.cust.swisscom.ch (flastings) [109.164.246.53]:57189: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Jan 28 10:43:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.226.114
description:
2025-01-28 10:43:17 H=(mail.aitedu.net) [165.154.226.114]:61486 F=<ggmvpf@aitedu.net> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 28 10:43:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-01-28 10:43:43 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:50234: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-01-28 10:44:07 dovecot_plain authenticator failed for ([185.129.114.190]) [185.129.114.190]:42822: 535 Incorrect authentication data (set_id=ads07b99022y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.167.19.189
description:
Jan 28 10:44:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.167.19.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.102.233
description:
Jan 28 10:43:57 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.102.233 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.102.233
description:
2025-01-28 10:43:59 dovecot_plain authenticator failed for ([183.236.102.233]) [183.236.102.233]:38017: 535 Incorrect authentication data (set_id=ads07b99022y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Jan 28 10:44:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.108.83.138
description:
Jan 28 10:44:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.108.83.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.72.123.47
description:
Jan 28 10:43:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.72.123.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.123.47
description:
2025-01-28 10:43:58 dovecot_login authenticator failed for (dynamic-adsl.viettel.vn) [27.72.123.47]:45366: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.167.19.189
description:
2025-01-28 10:44:42 dovecot_plain authenticator failed for ([60.167.19.189]) [60.167.19.189]:55345: 535 Incorrect authentication data (set_id=admin@elma-hk.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 28 10:45:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-28 10:45:10 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:53626: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 10:45:32 ait sshd[3562613]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
description:
2025-01-28 10:45:37 dovecot_plain authenticator failed for ([196.28.226.124]) [196.28.226.124]:60604: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.143.166.130
description:
2025-01-28 10:45:48 dovecot_plain authenticator failed for 130.sub-166-143-166.myvzw.com [166.143.166.130]:50764: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-28 10:44:58 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:59432: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 10:45:32 ait sshd[3562613]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 10:45:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 27.147.224.110
description:
[2025-01-28 10:45:41 +0100] info [webmaild] 27.147.224.110 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.143.166.130
description:
Jan 28 10:45:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.143.166.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.108.83.138
description:
2025-01-28 10:44:52 dovecot_plain authenticator failed for ([61.108.83.138]) [61.108.83.138]:49546: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 28 10:44:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.124
description:
Jan 28 10:45:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.224.89.112
description:
Jan 28 10:46:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.224.89.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
description:
2025-01-28 10:46:37 dovecot_plain authenticator failed for ([14.194.128.158]) [14.194.128.158]:36992: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.67.143.142
description:
Jan 28 10:46:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.67.143.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-28 10:46:38 dovecot_login authenticator failed for ([2.57.219.6]) [2.57.219.2]:42720: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.116.23.24
description:
2025-01-28 10:46:00 dovecot_login authenticator failed for (host24.helenandrews.com) [63.116.23.24]:35840: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.149.203.183
description:
2025-01-28 10:46:13 dovecot_login authenticator failed for ([221.149.203.183]) [221.149.203.183]:56864: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.153.166
description:
Jan 28 10:46:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.153.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.76
description:
Jan 28 10:46:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.224.89.112
description:
2025-01-28 10:46:16 dovecot_login authenticator failed for (112.89.224.159.triolan.net) [159.224.89.112]:58795: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.67.143.142
description:
2025-01-28 10:46:28 dovecot_login authenticator failed for (netcomafrica.com) [41.67.143.142]:46472: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
description:
Jan 28 10:46:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 28 10:46:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.228.220
description:
Jan 28 10:46:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.228.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.116.23.24
description:
Jan 28 10:45:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.116.23.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.76
description:
2025-01-28 10:46:06 dovecot_login authenticator failed for ([104.241.233.76]) [104.241.233.76]:32874: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.149.203.183
description:
Jan 28 10:46:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.149.203.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.153.166
description:
2025-01-28 10:46:28 dovecot_plain authenticator failed for (200-205-223-1.customer.tdatabrasil.net.br) [187.93.153.166]:59987: 535 Incorrect authentication data (set_id=bscj19bit0046y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.228.220
description:
2025-01-28 10:46:44 dovecot_plain authenticator failed for ([60.174.228.220]) [60.174.228.220]:40851: 535 Incorrect authentication data (set_id=bscj19bit0046y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.97.236.1
description:
2025-01-28 10:46:55 dovecot_plain authenticator failed for (ip-189-97-236-1.user.vivozap.com.br) [189.97.236.1]:56209: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 10:47:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.194.193.7
description:
Jan 28 10:47:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.194.193.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 183.110.200.43
description:
Jan 28 10:47:30 ait sshd[3563348]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=183.110.200.43  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.97.236.1
description:
Jan 28 10:46:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.97.236.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.73
description:
Jan 28 10:47:05 ait sshd[3563185]: pam_imunify(sshd:auth): [IM360_RBL] The IP 92.118.39.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 92.118.39.73
description:
Jan 28 10:47:05 ait sshd[3563185]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.118.39.73


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.193.7
description:
2025-01-28 10:47:12 dovecot_login authenticator failed for ([120.194.193.7]) [120.194.193.7]:38352: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.247
description:
Jan 28 10:47:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.110.200.43
description:
Jan 28 10:47:30 ait sshd[3563348]: pam_imunify(sshd:auth): [IM360_RBL] The IP 183.110.200.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.247
description:
2025-01-28 10:47:24 dovecot_login authenticator failed for ([104.241.234.247]) [104.241.234.247]:46748: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.201.247.187
description:
[2025-01-28 10:48:49 +0100] info [webmaild] 91.201.247.187 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.232.193.44
description:
Jan 28 10:48:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.232.193.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.138.185
description:
2025-01-28 10:48:23 dovecot_plain authenticator failed for ([120.198.138.185]) [120.198.138.185]:48671: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
description:
2025-01-28 10:48:35 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:40072: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 43.138.150.67
description:
Jan 28 10:48:47 ait sshd[3563681]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=43.138.150.67  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 28 10:48:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-28 10:48:12 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:38352: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.51.228
description:
[2025-01-28 10:47:55 +0100] info [webmaild] 177.200.51.228 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.232.193.44
description:
2025-01-28 10:48:21 dovecot_login authenticator failed for (186-232-193-44.PROXXIMA.NET) [186.232.193.44]:44090: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.45.11.79
description:
Jan 28 10:48:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.45.11.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.138.150.67
description:
Jan 28 10:48:47 ait sshd[3563681]: pam_imunify(sshd:auth): [IM360_RBL] The IP 43.138.150.67 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.194.145
description:
[2025-01-28 10:48:10 +0100] info [webmaild] 45.179.194.145 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.138.185
description:
Jan 28 10:48:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.138.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 28 10:49:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.216.119.13
description:
Jan 28 10:49:27 ait sshd[3563967]: pam_imunify(sshd:auth): [IM360_RBL] The IP 118.216.119.13 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 118.216.119.13
description:
Jan 28 10:49:27 ait sshd[3563967]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=118.216.119.13  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.28.192.118
description:
Jan 28 10:49:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.28.192.118 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.237.119.153
description:
[2025-01-28 10:49:38 +0100] info [webmaild] 212.237.119.153 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-28 10:49:18 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:44066: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-28 10:49:24 dovecot_login authenticator failed for ([216.194.174.27]) [216.194.174.27]:53331: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.174.34.49
description:
Jan 28 10:49:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.174.34.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.34.49
description:
2025-01-28 10:49:35 dovecot_login authenticator failed for ([103.174.34.49]) [103.174.34.49]:56729: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.36.98.58
description:
[2025-01-28 10:48:58 +0100] info [webmaild] 138.36.98.58 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 28 10:49:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 93.170.223.39
description:
[2025-01-28 10:49:11 +0100] info [webmaild] 93.170.223.39 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-28 10:49:10 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:54220: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 28 10:49:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.28.192.118
description:
2025-01-28 10:49:33 dovecot_login authenticator failed for ([1.28.192.118]) [1.28.192.118]:41345: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-28 10:50:25 dovecot_login authenticator failed for ([211.107.21.221]) [121.168.116.150]:52309: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.32.209.51
description:
Jan 28 10:50:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.32.209.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.141.241.229
description:
Jan 28 10:49:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.141.241.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.141.241.229
description:
2025-01-28 10:49:54 dovecot_login authenticator failed for 229.sub-166-141-241.myvzw.com [166.141.241.229]:57346: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.146.236
description:
[2025-01-28 10:50:17 +0100] info [webmaild] 186.224.146.236 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 28 10:50:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.32.209.51
description:
2025-01-28 10:50:45 dovecot_login authenticator failed for ([217.32.209.50]) [217.32.209.51]:41054: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 28 10:51:05 ait sshd[3564855]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.225.116.200
description:
[2025-01-28 10:51:46 +0100] info [webmaild] 200.225.116.200 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.82.132.8
description:
[2025-01-28 10:50:52 +0100] info [webmaild] 177.82.132.8 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.192.101.4
description:
[2025-01-28 10:51:04 +0100] info [webmaild] 186.192.101.4 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 28 10:51:05 ait sshd[3564855]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.171.160
description:
[2025-01-28 10:51:18 +0100] info [webmaild] 177.37.171.160 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.165.140
description:
2025-01-28 10:52:48 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.165.140]:39828: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.0.78.199
description:
Jan 28 10:52:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.0.78.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.0.78.199
description:
2025-01-28 10:52:35 dovecot_login authenticator failed for ([221.0.78.199]) [221.0.78.199]:12982: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.165.140
description:
Jan 28 10:52:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.165.140 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.196.226.114
description:
[2025-01-28 10:51:58 +0100] info [webmaild] 168.196.226.114 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.170.48.178
description:
Jan 28 10:53:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.170.48.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.182.116.64
description:
2025-01-28 10:53:42 dovecot_plain authenticator failed for (anclan) [62.182.116.64]:35056: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.219.13.139
description:
[2025-01-28 10:53:01 +0100] info [webmaild] 138.219.13.139 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 10:53:15 ait sshd[3565815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 10:53:15 ait sshd[3565815]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.182.116.64
description:
Jan 28 10:53:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.182.116.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.170.48.178
description:
2025-01-28 10:53:44 dovecot_plain authenticator failed for (unify) [188.170.48.178]:43673: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.121.104.153
description:
Jan 28 10:55:01 ait sshd[3566522]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.121.104.153 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.121.104.153
description:
Jan 28 10:55:01 ait sshd[3566522]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.121.104.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.63.230.241
description:
2025-01-28 10:55:09 dovecot_plain authenticator failed for h-62-63-230-241.a980.priv.bahnhof.se (fedefulmon) [62.63.230.241]:42368: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.63.230.241
description:
Jan 28 10:55:07 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.63.230.241 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.202.151
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:10-55.157.245.202.151


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.21.140.240
description:
[2025-01-28 10:56:47 +0100] info [webmaild] 177.21.140.240 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:56:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 10:56:52 ait sshd[3567435]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.150.135.19
description:
Jan 28 10:57:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.150.135.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.150.135.19
description:
2025-01-28 10:57:38 dovecot_login authenticator failed for (19.135.150.178.triolan.net) [178.150.135.19]:2979: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 28 10:57:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 28 10:57:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 10:57:29 ait sshd[3567684]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.165.140
description:
2025-01-28 10:57:49 dovecot_login authenticator failed for ([103.250.160.76]) [117.198.165.140]:54638: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 10:56:52 ait sshd[3567435]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:57:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 10:57:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 10:57:29 ait sshd[3567684]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.198.165.140
description:
Jan 28 10:57:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.198.165.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-28 10:57:40 dovecot_plain authenticator failed for mail.schindler-statik.at (pudleously) [80.120.186.246]:43442: 535 Incorrect authentication data (set_id=abs19a00020y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-28 10:57:51 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com (josiblidon) [24.168.26.166]:38624: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.62.20.170
description:
Jan 28 10:58:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.62.20.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.139.88.148
description:
Jan 28 10:58:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.139.88.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.143.115.18
description:
2025-01-28 10:58:12 dovecot_login authenticator failed for (18.115.143.122.adsl-pool.jlccptt.net.cn) [122.143.115.18]:53138: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.21.178
description:
2025-01-28 10:58:38 dovecot_plain authenticator failed for 111-70-21-178.emome-ip.hinet.net [111.70.21.178]:49294: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.194.40
description:
2025-01-28 10:58:16 dovecot_plain authenticator failed for (estra) [65.20.194.40]:58187: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.163.154.14
description:
Jan 28 10:58:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.163.154.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.4.0.180
description:
Jan 28 10:58:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.4.0.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.4.0.180
description:
2025-01-28 10:58:42 dovecot_login authenticator failed for 110-4-0-180.static.pccw-hkt.com [110.4.0.180]:63964: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 28 10:57:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.162.187
description:
2025-01-28 10:57:53 dovecot_plain authenticator failed for (mathes) [65.20.162.187]:57286: 535 Incorrect authentication data (set_id=eng20a00115y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.88.148
description:
2025-01-28 10:58:06 dovecot_plain authenticator failed for 148.red-2-139-88.dynamicip.rima-tde.net (reateromer) [2.139.88.148]:45018: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.162.187
description:
Jan 28 10:57:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.162.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.194.40
description:
Jan 28 10:58:14 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.194.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.42.124.80
description:
2025-01-28 10:58:44 dovecot_login authenticator failed for 179-42-124-80.chtch.com.br [179.42.124.80]:34125: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-28 10:57:53 dovecot_plain authenticator failed for (defierly) [109.108.95.66]:40422: 535 Incorrect authentication data (set_id=eng20a00052y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 10:58:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.138.196.194
description:
Jan 28 10:58:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.138.196.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.178.114
description:
2025-01-28 10:58:13 dovecot_plain authenticator failed for (merially) [65.20.178.114]:39525: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.178.114
description:
Jan 28 10:58:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.178.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.21.178
description:
Jan 28 10:58:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.21.178 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.42.124.80
description:
Jan 28 10:58:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.42.124.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.161.184.58
description:
Jan 28 10:58:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.161.184.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-28 10:58:33 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:52354: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-28 10:58:44 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:47548: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.49.146
description:
2025-01-28 10:57:58 dovecot_login authenticator failed for ([94.206.49.146]) [94.206.49.146]:33922: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.143.115.18
description:
Jan 28 10:58:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.143.115.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.138.196.194
description:
2025-01-28 10:58:14 dovecot_plain authenticator failed for ([200.138.196.194]) [200.138.196.194]:59038: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.163.154.14
description:
2025-01-28 10:58:22 dovecot_login authenticator failed for ([46.163.154.14]) [46.163.154.14]:51562: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.49.146
description:
Jan 28 10:57:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.49.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.62.20.170
description:
2025-01-28 10:58:02 dovecot_plain authenticator failed for syn-074-062-020-170.biz.spectrum.com [74.62.20.170]:54456: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.58
description:
2025-01-28 10:58:17 dovecot_plain authenticator failed for ([131.161.184.58]) [131.161.184.58]:54022: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 28 10:58:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 10:58:08 dovecot_plain authenticator failed for (suble) [147.235.97.158]:65249: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 28 10:58:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 28 10:59:12 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-28 10:59:14 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:60041: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.0.112
description:
Jan 28 10:58:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.0.112 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-01-28 10:58:54 dovecot_login authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:34450: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.10
description:
Jan 28 10:58:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.121.104.153
description:
Jan 28 10:59:09 ait sshd[3568275]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.121.104.153 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-28 10:59:38 dovecot_plain authenticator failed for (babless) [77.239.255.163]:43682: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.44.163
description:
Jan 28 10:58:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.44.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.0.19.108
description:
Jan 28 10:58:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.0.19.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.44.163
description:
2025-01-28 10:58:57 dovecot_login authenticator failed for (abts-tn-static-159.137.165.122.airtelbroadband.in) [103.109.44.163]:38466: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.0.112
description:
2025-01-28 10:58:57 dovecot_login authenticator failed for 111-70-0-112.emome-ip.hinet.net [111.70.0.112]:44734: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 10:59:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.172.24
description:
Jan 28 10:59:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.172.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Jan 28 10:58:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.0.19.108
description:
2025-01-28 10:58:58 dovecot_plain authenticator failed for (unshamil) [149.0.19.108]:34668: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.10
description:
2025-01-28 10:58:58 dovecot_login authenticator failed for (m121-202-155-10.smartone.com) [121.202.155.10]:13333: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.121.104.153
description:
Jan 28 10:59:09 ait sshd[3568275]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.121.104.153


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.172.24
description:
2025-01-28 10:59:35 dovecot_plain authenticator failed for (triothisma) [65.20.172.24]:58428: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 28 10:59:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 188.121.104.153
description:
Jan 28 11:00:37 ait sshd[3569037]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=188.121.104.153


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.131.243.139
description:
[2025-01-28 11:00:39 +0100] info [webmaild] 201.131.243.139 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.194.7.10
description:
2025-01-28 11:00:07 dovecot_login authenticator failed for ([120.194.7.10]) [120.194.7.10]:40599: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 28 11:00:31 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 188.121.104.153
description:
Jan 28 11:00:39 ait sshd[3569037]: Failed password for invalid user dde from 188.121.104.153 port 54520 ssh2


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.251.80.163
description:
[2025-01-28 11:00:44 +0100] info [webmaild] 186.251.80.163 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.254.212.134
description:
[2025-01-28 11:00:47 +0100] info [webmaild] 179.254.212.134 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.77.200.93
description:
[2025-01-28 11:00:16 +0100] info [webmaild] 5.77.200.93 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.205.112.156
description:
Jan 28 11:00:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.205.112.156 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.205.112.156
description:
2025-01-28 11:00:21 dovecot_login authenticator failed for (190-205-112-156.static.cantv.net) [190.205.112.156]:52468: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-28 11:00:33 dovecot_plain authenticator failed for (batious) [65.20.183.209]:54198: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.121.104.153
description:
Jan 28 11:00:37 ait sshd[3569037]: pam_imunify(sshd:auth): [IM360_RBL] The IP 188.121.104.153 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 130.193.219.46
description:
[2025-01-28 10:59:57 +0100] info [webmaild] 130.193.219.46 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.19.170.166
description:
2025-01-28 11:01:34 dovecot_login authenticator failed for ([202.188.165.198]) [210.19.170.166]:59775: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 9708
name: Dovecot Aborted Login with empty user
abuser: 185.247.137.228
description:
Jan 28 11:01:17 ait dovecot[3471522]: imap-login: Disconnected: Aborted login by logging out (no auth attempts in 6 secs): user=<>, rip=185.247.137.228, lip=136.243.145.84, TLS, session=<ggIlRsEsLdS594nk>


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.11.28.140
description:
[2025-01-28 11:01:18 +0100] info [webmaild] 177.11.28.140 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.19.170.166
description:
Jan 28 11:01:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.19.170.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.124.123
description:
Jan 28 11:02:00 ait sshd[3569763]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.124.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.124.123
description:
Jan 28 11:02:00 ait sshd[3569763]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.124.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 11:02:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.218.181.19
description:
Jan 28 11:02:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.218.181.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.40
description:
Jan 28 11:02:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 28 11:02:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-28 11:02:08 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:41984: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.58.230
description:
Jan 28 11:02:48 ait sshd[3570008]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.99.58.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.58.230
description:
Jan 28 11:02:48 ait sshd[3570008]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.58.230


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.179.112.39
description:
[2025-01-28 11:02:34 +0100] info [webmaild] 45.179.112.39 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.218.181.19
description:
2025-01-28 11:02:45 dovecot_plain authenticator failed for ([201.218.181.19]) [201.218.181.19]:51162: 535 Incorrect authentication data (set_id=eng20a00118y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.196.31.2
description:
Jan 28 11:01:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.196.31.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.40
description:
2025-01-28 11:02:04 dovecot_login authenticator failed for (m121-202-154-40.smartone.com) [121.202.154.40]:5776: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.113.17.222
description:
[2025-01-28 11:02:12 +0100] info [webmaild] 103.113.17.222 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.38.239.52
description:
Jan 28 11:02:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.38.239.52 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.208.15
description:
[2025-01-28 11:02:27 +0100] info [webmaild] 37.236.208.15 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.125.89.62
description:
[2025-01-28 11:02:30 +0100] info [webmaild] 186.125.89.62 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
description:
2025-01-28 11:01:57 dovecot_login authenticator failed for ([121.128.76.108]) [211.196.31.2]:60096: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.41.18
description:
Jan 28 11:02:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.41.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.41.18
description:
2025-01-28 11:02:17 dovecot_login authenticator failed for ([94.206.41.18]) [94.206.41.18]:60193: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.38.239.52
description:
2025-01-28 11:02:22 dovecot_login authenticator failed for ([118.38.239.52]) [118.38.239.52]:55080: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.224.159.218
description:
2025-01-28 11:03:10 dovecot_plain authenticator failed for ([221.224.159.220]) [221.224.159.218]:38256: 535 Incorrect authentication data (set_id=eng20a00118y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
description:
2025-01-28 11:03:25 dovecot_login authenticator failed for (techday.com.ua) [46.149.83.62]:39551: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 164.164.117.23
description:
Jan 28 11:03:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 164.164.117.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.29.185.162
description:
2025-01-28 11:03:29 dovecot_login authenticator failed for (ip-103-29-185-162.pascalwave.com) [103.29.185.162]:51632: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.85.52.109
description:
Jan 28 11:02:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.85.52.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.224.159.218
description:
Jan 28 11:03:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.224.159.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.76.87.90
description:
Jan 28 11:03:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.76.87.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.87.90
description:
2025-01-28 11:03:10 dovecot_login authenticator failed for (nsg-static-174.125.76.182-airtel.com) [182.76.87.90]:55344: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.178.79.38
description:
2025-01-28 11:03:20 dovecot_login authenticator failed for ([211.178.79.38]) [211.178.79.38]:49223: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.216.0.10
description:
Jan 28 11:03:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.216.0.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.125.134.122
description:
[2025-01-28 11:03:41 +0100] info [webmaild] 179.125.134.122 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.85.52.109
description:
2025-01-28 11:02:57 dovecot_login authenticator failed for 77-85-52-109.ip.btc-net.bg [77.85.52.109]:49751: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.22.218
description:
2025-01-28 11:03:17 dovecot_login authenticator failed for ([5.32.22.218]) [5.32.22.218]:52584: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.178.79.38
description:
Jan 28 11:03:18 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.178.79.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.149.83.62
description:
Jan 28 11:03:23 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.149.83.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.29.185.162
description:
Jan 28 11:03:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.29.185.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 164.164.117.23
description:
2025-01-28 11:03:30 dovecot_login authenticator failed for ([164.164.117.23]) [164.164.117.23]:47710: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
description:
Jan 28 11:03:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
description:
Jan 28 11:03:15 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.62.233.146
description:
2025-01-28 11:03:26 dovecot_plain authenticator failed for ([103.62.233.146]) [103.62.233.146]:42791: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.216.0.10
description:
2025-01-28 11:03:35 dovecot_login authenticator failed for ([124.216.0.10]) [124.216.0.10]:40227: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
description:
2025-01-28 11:03:39 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:41767: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.166.112.154
description:
Jan 28 11:03:53 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.166.112.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 28 11:04:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 158.181.151.77
description:
[2025-01-28 11:04:05 +0100] info [webmaild] 158.181.151.77 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.166.112.154
description:
2025-01-28 11:03:55 dovecot_login authenticator failed for (173-166-112-154-newengland.hfc.comcastbusiness.net) [173.166.112.154]:49170: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-28 11:04:04 dovecot_plain authenticator failed for (supplince) [147.235.97.158]:28879: 535 Incorrect authentication data (set_id=callahan.55116@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:04:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.117.161.9
description:
[2025-01-28 11:04:33 +0100] info [webmaild] 103.117.161.9 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.161.197
description:
Jan 28 11:05:29 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.161.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.51.184.194
description:
2025-01-28 11:04:52 dovecot_plain authenticator failed for ([114.242.172.76]) [61.51.184.194]:52723: 535 Incorrect authentication data (set_id=ads69b66600y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 28 11:05:02 ait sshd[3570899]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.54.18.220
description:
Jan 28 11:05:05 ait sshd[3571230]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-28 11:05:27 dovecot_plain authenticator failed for (rocroones) [91.116.42.218]:45454: 535 Incorrect authentication data (set_id=ads21b00202y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.30.161.197
description:
2025-01-28 11:05:31 dovecot_plain authenticator failed for (unductylla) [46.30.161.197]:59925: 535 Incorrect authentication data (set_id=abs20b00166y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.33.87.111
description:
Jan 28 11:05:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.33.87.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.33.87.111
description:
2025-01-28 11:05:02 dovecot_plain authenticator failed for (111-86-33-194.intelcom-ug.ru) [194.33.87.111]:53742: 535 Incorrect authentication data (set_id=ads69b66600y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 28 11:05:02 ait sshd[3570899]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.161.188
description:
Jan 28 11:05:48 ait sshd[3571624]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.161.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.161.188
description:
Jan 28 11:05:48 ait sshd[3571624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.161.188  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.51.184.194
description:
Jan 28 11:04:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.51.184.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 28 11:05:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.236.21.232
description:
[2025-01-28 11:05:47 +0100] info [webmaild] 179.236.21.232 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.54.18.220
description:
Jan 28 11:05:05 ait sshd[3571230]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.54.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.219.222.15
description:
Jan 28 11:06:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.219.222.15 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.54.18.220
description:
Jan 28 11:06:39 ait sshd[3571952]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.206.193.131
description:
Jan 28 11:06:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.206.193.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.58.230
description:
Jan 28 11:05:52 ait sshd[3571642]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.99.58.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.180.230.98
description:
Jan 28 11:06:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.180.230.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.27.1
description:
Jan 28 11:06:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.27.1 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.58.230
description:
Jan 28 11:05:52 ait sshd[3571642]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.58.230


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.180.230.98
description:
2025-01-28 11:06:18 dovecot_plain authenticator failed for ([1.180.230.98]) [1.180.230.98]:59600: 535 Incorrect authentication data (set_id=ds18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.219.222.15
description:
2025-01-28 11:06:34 dovecot_plain authenticator failed for ([207.219.222.15]) [207.219.222.15]:57387: 535 Incorrect authentication data (set_id=ds18b00116y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.206.193.131
description:
2025-01-28 11:06:43 dovecot_plain authenticator failed for host-37-206-193-131.business.telecomitalia.it [37.206.193.131]:42156: 535 Incorrect authentication data (set_id=ads20a00244y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.27.1
description:
2025-01-28 11:06:35 dovecot_plain authenticator failed for ([103.145.27.106]) [103.145.27.1]:54736: 535 Incorrect authentication data (set_id=ads20a00244y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.54.18.220
description:
Jan 28 11:06:39 ait sshd[3571952]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.54.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.34.127
description:
Jan 28 11:06:59 ait sshd[3572002]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.34.127  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.161.188
description:
Jan 28 11:07:43 ait sshd[3572320]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.161.188


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.109.164.46
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:11-07.65.109.164.46


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.99.58.230
description:
Jan 28 11:07:03 ait sshd[3572023]: pam_imunify(sshd:auth): [IM360_RBL] The IP 167.99.58.230 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 167.99.58.230
description:
Jan 28 11:07:03 ait sshd[3572023]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=167.99.58.230


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 167.99.58.230
description:
Jan 28 11:07:05 ait sshd[3572023]: Failed password for invalid user user from 167.99.58.230 port 46588 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.161.188
description:
Jan 28 11:07:43 ait sshd[3572320]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.161.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.34.127
description:
Jan 28 11:06:59 ait sshd[3572002]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.34.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-28 11:08:35 dovecot_plain authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:22007: 535 Incorrect authentication data (set_id=admin@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.224.15.67
description:
2025-01-28 11:08:46 dovecot_plain authenticator failed for ([120.224.15.67]) [120.224.15.67]:2454: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 28 11:08:06 ait sshd[3572499]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.54.18.220
description:
Jan 28 11:08:12 ait sshd[3572515]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.54.18.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.189.68.225
description:
[2025-01-28 11:08:03 +0100] info [webmaild] 103.189.68.225 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 28 11:08:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.224.15.67
description:
Jan 28 11:08:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.224.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 28 11:08:06 ait sshd[3572499]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.20.29.108
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:awadzie@ait.edu.gh||WPU:awadzie@ait.edu.gh||RSV:6.65||T:APACHE||MV:11-08.178.20.29.108


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.54.18.220
description:
Jan 28 11:08:12 ait sshd[3572515]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.54.18.220


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.227.77.118
description:
2025-01-28 11:09:38 dovecot_login authenticator failed for ([122.227.77.118]) [122.227.77.118]:57459: 535 Incorrect authentication data (set_id=valeria553@ait-edu.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.130.200.51
description:
2025-01-28 11:09:37 dovecot_plain authenticator failed for mail.infologic.co.il (ratizi) [85.130.200.51]:51605: 535 Incorrect authentication data (set_id=admin@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.228.121.220
description:
Jan 28 11:09:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.228.121.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.130.200.51
description:
Jan 28 11:09:35 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.130.200.51 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.128
description:
2025-01-28 11:08:56 dovecot_plain authenticator failed for ([178.178.194.128]) [178.178.194.128]:38708: 535 Incorrect authentication data (set_id=eng21a00034y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.254.126.238
description:
2025-01-28 11:09:04 dovecot_plain authenticator failed for c83-254-126-238.bredband.tele2.se [83.254.126.238]:36498: 535 Incorrect authentication data (set_id=eng21a00034y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.227.77.118
description:
Jan 28 11:09:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.227.77.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.254.126.238
description:
Jan 28 11:09:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.254.126.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.228.121.220
description:
2025-01-28 11:09:10 dovecot_plain authenticator failed for c-85-228-121-220.bbcust.telenor.se (pronly) [85.228.121.220]:42150: 535 Incorrect authentication data (set_id=eng27b00340y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.128
description:
Jan 28 11:08:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.85.205
description:
2025-01-28 11:10:11 dovecot_login authenticator failed for 131-106-85-205.s1483.c3-0.tlg-cbr5.atw-tlg.pa.cable.rcncustomer.com [131.106.85.205]:51164: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.161.188
description:
Jan 28 11:10:16 ait sshd[3573293]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.161.188 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.161.188
description:
Jan 28 11:10:16 ait sshd[3573293]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.161.188  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.154.199.12
description:
Jan 28 11:10:16 ait sshd[3573316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 207.154.199.12 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 207.154.199.12
description:
Jan 28 11:10:16 ait sshd[3573316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=207.154.199.12  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.93.22.46
description:
2025-01-28 11:10:00 dovecot_login authenticator failed for (187-93-22-46.customer.tdatabrasil.net.br) [187.93.22.46]:44332: 535 Incorrect authentication data (set_id=valeria553)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.85.205
description:
Jan 28 11:10:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.85.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.93.22.46
description:
Jan 28 11:09:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.93.22.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.75.218.103
description:
Jan 28 11:11:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.75.218.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.75.218.103
description:
2025-01-28 11:11:21 dovecot_plain authenticator failed for ([103.55.89.5]) [116.75.218.103]:49748: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.46.128.225
description:
Jan 28 11:11:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.46.128.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.46.128.225
description:
2025-01-28 11:11:29 dovecot_plain authenticator failed for ([178.46.128.225]) [178.46.128.225]:36797: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.250.191.189
description:
Jan 28 11:10:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.250.191.189 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.124.123
description:
Jan 28 11:10:57 ait sshd[3573673]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.124.123


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.250.191.189
description:
2025-01-28 11:10:54 dovecot_plain authenticator failed for (forcul) [178.250.191.189]:53318: 535 Incorrect authentication data (set_id=reply@manager.elma-hk.com)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.124.123
description:
Jan 28 11:10:57 ait sshd[3573673]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.124.123 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.185.93.223
description:
[2025-01-28 11:12:04 +0100] info [webmaild] 45.185.93.223 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.109.95.157
description:
[2025-01-28 11:12:30 +0100] info [webmaild] 103.109.95.157 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.102.148.242
description:
2025-01-28 11:12:42 dovecot_plain authenticator failed for syn-098-102-148-242.biz.spectrum.com [98.102.148.242]:55324: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 176.88.125.213
description:
[2025-01-28 11:11:59 +0100] info [webmaild] 176.88.125.213 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.114.32.79
description:
[2025-01-28 11:12:20 +0100] info [webmaild] 190.114.32.79 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.102.148.242
description:
Jan 28 11:12:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.102.148.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.47.146.47
description:
[2025-01-28 11:12:12 +0100] info [webmaild] 212.47.146.47 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 196.65.166.249
description:
[2025-01-28 11:13:01 +0100] info [webmaild] 196.65.166.249 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:13:19 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.52.141.112
description:
[2025-01-28 11:13:25 +0100] info [webmaild] 185.52.141.112 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.182.152.134
description:
[2025-01-28 11:13:41 +0100] info [webmaild] 201.182.152.134 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.31.181.219
description:
Jan 28 11:12:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.31.181.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.31.181.219
description:
2025-01-28 11:12:54 dovecot_plain authenticator failed for ([60.31.181.219]) [60.31.181.219]:57129: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.90
description:
2025-01-28 11:14:24 dovecot_plain authenticator failed for ([27.24.141.90]) [27.24.141.90]:47760: 535 Incorrect authentication data (set_id=adsby@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.125.124.123
description:
Jan 28 11:14:26 ait sshd[3575123]: pam_imunify(sshd:auth): [IM360_RBL] The IP 113.125.124.123 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 113.125.124.123
description:
Jan 28 11:14:26 ait sshd[3575123]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=113.125.124.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 28 11:14:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.172.60.154
description:
Jan 28 11:14:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.172.60.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-28 11:14:35 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (trootile) [85.69.178.104]:58692: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.71.221.162
description:
[2025-01-28 11:14:14 +0100] info [webmaild] 201.71.221.162 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.90
description:
Jan 28 11:14:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.172.60.154
description:
2025-01-28 11:14:35 dovecot_plain authenticator failed for ([220.172.60.154]) [220.172.60.154]:48436: 535 Incorrect authentication data (set_id=adsby)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.4.134
description:
[2025-01-28 11:14:07 +0100] info [webmaild] 37.238.4.134 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-28 11:15:30 dovecot_plain authenticator failed for (sperpike) [91.116.42.218]:45716: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 11:15:48 ait sshd[3575976]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
description:
2025-01-28 11:15:49 dovecot_plain authenticator failed for (eudiser) [102.53.15.18]:38511: 535 Incorrect authentication data (set_id=ads21a00042y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 28 11:15:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.74.66.49
description:
[2025-01-28 11:15:31 +0100] info [webmaild] 105.74.66.49 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.18
description:
Jan 28 11:15:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 11:15:48 ait sshd[3575976]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.15.38.55
description:
[2025-01-28 11:15:59 +0100] info [webmaild] 185.15.38.55 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.236.82.60
description:
[2025-01-28 11:16:06 +0100] info [webmaild] 186.236.82.60 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 11:16:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 11:16:26 dovecot_plain authenticator failed for (upectops) [81.211.77.58]:18367: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.36.207.16
description:
[2025-01-28 11:17:32 +0100] info [webmaild] 191.36.207.16 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:18:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 28 11:18:02 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-28 11:18:04 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:43654: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.239.231.61
description:
Jan 28 11:18:16 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.239.231.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.239.231.61
description:
2025-01-28 11:18:18 dovecot_login authenticator failed for ([222.239.231.61]) [222.239.231.61]:19396: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 28 11:19:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 28 11:19:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-28 11:19:44 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:34456: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.200.230.162
description:
[2025-01-28 11:19:07 +0100] info [webmaild] 177.200.230.162 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 28 11:20:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.45.11.79
description:
Jan 28 11:20:38 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.45.11.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.218.17.45
description:
Jan 28 11:20:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.218.17.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.253.50
description:
2025-01-28 11:19:57 dovecot_plain authenticator failed for ([112.91.253.50]) [112.91.253.50]:51659: 535 Incorrect authentication data (set_id=ads23a00041y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Jan 28 11:20:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.135.74
description:
2025-01-28 11:20:08 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:37108: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.45.11.79
description:
2025-01-28 11:20:40 dovecot_login authenticator failed for host79.sub-63-45-11.myvzw.com [63.45.11.79]:56522: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 28 11:20:49 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-28 11:20:51 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38512: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.37.79.247
description:
2025-01-28 11:19:53 dovecot_login authenticator failed for ([14.37.79.247]) [14.37.79.247]:40633: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.71.98.202
description:
Jan 28 11:20:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.71.98.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.253.50
description:
Jan 28 11:19:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.253.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.61.6
description:
Jan 28 11:20:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.61.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.61.6
description:
2025-01-28 11:20:19 dovecot_login authenticator failed for ([5.32.61.6]) [5.32.61.6]:36349: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.218.17.45
description:
2025-01-28 11:20:42 dovecot_login authenticator failed for ([222.218.17.45]) [222.218.17.45]:36110: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.37.79.247
description:
Jan 28 11:19:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.37.79.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 28 11:19:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 11:21:28 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 11:21:30 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (raphy) [87.103.126.54]:63282: 535 Incorrect authentication data (set_id=ads19b00251y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.255.84.180
description:
Jan 28 11:21:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.255.84.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.255.84.180
description:
2025-01-28 11:21:02 dovecot_plain authenticator failed for ns3042085.ip-51-255-84.eu (churting) [51.255.84.180]:39090: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.17
description:
Jan 28 11:21:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.17
description:
2025-01-28 11:21:27 dovecot_plain authenticator failed for (ouning) [102.53.15.17]:36763: 535 Incorrect authentication data (set_id=ads21b11212y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 28 11:21:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.186.40.110
description:
Jan 28 11:22:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.186.40.110 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 28 11:22:04 ait sshd[3579315]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.109.93.130
description:
Jan 28 11:22:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.109.93.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.109.93.130
description:
2025-01-28 11:22:12 dovecot_login authenticator failed for ([211.109.93.130]) [211.109.93.130]:33802: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.79
description:
Jan 28 11:22:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.196.31.2
description:
Jan 28 11:22:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.196.31.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.196.31.2
description:
2025-01-28 11:22:35 dovecot_login authenticator failed for ([121.128.76.108]) [211.196.31.2]:40832: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.161.31.172
description:
Jan 28 11:22:26 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.161.31.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.79
description:
2025-01-28 11:22:35 dovecot_plain authenticator failed for (m121-202-155-79.smartone.com) [121.202.155.79]:36068: 535 Incorrect authentication data (set_id=abs18b00066y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 28 11:22:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.39.212.68
description:
Jan 28 11:22:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.39.212.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.148.248.251
description:
2025-01-28 11:21:58 dovecot_plain authenticator failed for c188-148-248-251.bredband.tele2.se (reareties) [188.148.248.251]:36340: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-28 11:22:00 dovecot_plain authenticator failed for (lastonadic) [93.159.152.6]:38484: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.222.244.89
description:
Jan 28 11:22:17 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.222.244.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.161.31.172
description:
2025-01-28 11:22:28 dovecot_login authenticator failed for (static.vnpt.vn) [14.161.31.172]:13882: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.239.109.147
description:
Jan 28 11:22:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.239.109.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.39.212.68
description:
2025-01-28 11:22:47 dovecot_plain authenticator failed for ([111.39.212.68]) [111.39.212.68]:33346: 535 Incorrect authentication data (set_id=abs18b00066y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.239.109.147
description:
2025-01-28 11:22:48 dovecot_login authenticator failed for ([221.239.109.147]) [221.239.109.147]:30392: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.148.248.251
description:
Jan 28 11:21:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.148.248.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.186.40.110
description:
2025-01-28 11:22:06 dovecot_login authenticator failed for ([89.211.42.163]) [37.186.40.110]:38498: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.222.244.89
description:
2025-01-28 11:22:19 dovecot_login authenticator failed for (89.244.222.60.adsl-pool.sx.cn) [60.222.244.89]:41654: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-28 11:22:46 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:41850: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.217
description:
Jan 28 11:23:05 ait sshd[3579723]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.217  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.59.174
description:
Jan 28 11:23:44 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.59.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 28 11:23:04 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.246.138.100
description:
Jan 28 11:23:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.246.138.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.59.174
description:
2025-01-28 11:23:46 dovecot_plain authenticator failed for ([222.236.59.174]) [222.236.59.174]:47803: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.238.202.4
description:
[2025-01-28 11:23:49 +0100] info [webmaild] 37.238.202.4 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.45.107.20
description:
[2025-01-28 11:23:49 +0100] info [webmaild] 177.45.107.20 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 107.80.220.155
description:
Jan 28 11:22:56 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 107.80.220.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.96.74.103
description:
[2025-01-28 11:23:46 +0100] info [webmaild] 212.96.74.103 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.7.26.195
description:
2025-01-28 11:23:26 dovecot_login authenticator failed for bb121-7-26-195.singnet.com.sg [121.7.26.195]:46146: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.80.220.155
description:
2025-01-28 11:22:58 dovecot_login authenticator failed for mobile-107-80-220-155.mycingular.net [107.80.220.155]:45781: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-28 11:23:06 dovecot_plain authenticator failed for (baratoid) [81.211.77.58]:45122: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.140.69
description:
Jan 28 11:23:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.140.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.140.69
description:
2025-01-28 11:23:11 dovecot_plain authenticator failed for (chied) [65.20.140.69]:49135: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.246.138.100
description:
2025-01-28 11:23:13 dovecot_login authenticator failed for ([43.246.138.100]) [43.246.138.100]:39888: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.7.26.195
description:
Jan 28 11:23:24 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.7.26.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.130.87.125
description:
Jan 28 11:24:08 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.130.87.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 28 11:24:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-28 11:24:22 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (larymit) [94.45.76.149]:59609: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.30.24
description:
Jan 28 11:24:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.30.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.108
description:
2025-01-28 11:24:44 dovecot_plain authenticator failed for p5b381f6c.dip0.t-ipconnect.de (eouse) [91.56.31.108]:60655: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.208.239.68
description:
[2025-01-28 11:23:59 +0100] info [webmaild] 186.208.239.68 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.8.1.13
description:
[2025-01-28 11:24:05 +0100] info [webmaild] 177.8.1.13 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.90.195.68
description:
Jan 28 11:24:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.90.195.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.30.24
description:
2025-01-28 11:24:45 dovecot_login authenticator failed for ([91.74.30.24]) [91.74.30.24]:50779: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.130.87.125
description:
2025-01-28 11:24:10 dovecot_plain authenticator failed for ([221.130.87.125]) [221.130.87.125]:41869: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.104.44.173
description:
[2025-01-28 11:24:39 +0100] info [webmaild] 5.104.44.173 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.108
description:
Jan 28 11:24:42 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.195.68
description:
2025-01-28 11:24:44 dovecot_plain authenticator failed for (197-90-195-68.dyn.mweb.co.za) [197.90.195.68]:44823: 535 Incorrect authentication data (set_id=dagyarko@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 28 11:24:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.155
description:
Jan 28 11:24:58 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
description:
2025-01-28 11:25:07 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:60218: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-28 11:24:54 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:44712: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 5.21.132.68
description:
[2025-01-28 11:25:01 +0100] info [webmaild] 5.21.132.68 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.146.201.37
description:
2025-01-28 11:25:11 dovecot_plain authenticator failed for ([221.146.201.37]) [221.146.201.37]:47234: 535 Incorrect authentication data (set_id=dagyarko)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.47.136.121
description:
[2025-01-28 11:25:47 +0100] info [webmaild] 212.47.136.121 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.146.201.37
description:
Jan 28 11:25:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.146.201.37 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 102.33.32.113
description:
[2025-01-28 11:25:40 +0100] info [webmaild] 102.33.32.113 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 28 11:25:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.155
description:
2025-01-28 11:25:00 dovecot_login authenticator failed for p7001156-ipoefx.ipoe.ocn.ne.jp [118.3.227.155]:51676: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-28 11:25:02 dovecot_plain authenticator failed for host81-143-51-58.in-addr.btopenworld.com (coula) [81.143.51.58]:45076: 535 Incorrect authentication data (set_id=sates2@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
description:
Jan 28 11:25:05 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.200.92.158
description:
[2025-01-28 11:25:47 +0100] info [webmaild] 103.200.92.158 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.237
description:
Jan 28 11:26:34 ait sshd[3581717]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.237  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.93.101
description:
Jan 28 11:26:05 ait sshd[3581469]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.93.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 90.0.156.128
description:
Jan 28 11:26:27 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 90.0.156.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.0.156.128
description:
2025-01-28 11:26:29 dovecot_plain authenticator failed for amontpellier-655-1-340-128.w90-0.abo.wanadoo.fr (gnousism) [90.0.156.128]:45126: 535 Incorrect authentication data (set_id=ads22a00092y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.237
description:
Jan 28 11:26:34 ait sshd[3581717]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.237 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 28 11:26:05 ait sshd[3581469]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.84.177.64
description:
[2025-01-28 11:27:19 +0100] info [webmaild] 189.84.177.64 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:27:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.58.124.145
description:
Jan 28 11:27:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.58.124.145 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.123.193.204
description:
[2025-01-28 11:27:47 +0100] info [webmaild] 94.123.193.204 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.206.101.19
description:
Jan 28 11:27:11 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.206.101.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.206.101.19
description:
2025-01-28 11:27:13 dovecot_plain authenticator failed for dslb-002-206-101-019.002.206.pools.vodafone-ip.de (subfammog) [2.206.101.19]:45760: 535 Incorrect authentication data (set_id=ads20a00071y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.58.124.145
description:
2025-01-28 11:27:27 dovecot_plain authenticator failed for 176-58-124-145.ip.linodeusercontent.com (perrebeta) [176.58.124.145]:40724: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:26:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.246.92.77
description:
Jan 28 11:28:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.246.92.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.246.92.77
description:
2025-01-28 11:28:32 dovecot_plain authenticator failed for ([124.246.92.77]) [124.246.92.77]:50441: 535 Incorrect authentication data (set_id=eng18a00033y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 28 11:28:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.84.209.146
description:
Jan 28 11:28:46 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.84.209.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-28 11:28:48 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (polandist) [87.103.126.54]:17614: 535 Incorrect authentication data (set_id=ads23a00041y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.84.209.146
description:
2025-01-28 11:28:48 dovecot_plain authenticator failed for ([88.84.209.146]) [88.84.209.146]:56156: 535 Incorrect authentication data (set_id=eng18a00033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.48.65.76
description:
[2025-01-28 11:28:14 +0100] info [webmaild] 200.48.65.76 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.200.216.246
description:
2025-01-28 11:29:35 dovecot_plain authenticator failed for ([113.200.216.246]) [113.200.216.246]:58234: 535 Incorrect authentication data (set_id=aabdulrahaman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.255.112.6
description:
Jan 28 11:29:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.255.112.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.255.112.6
description:
2025-01-28 11:29:49 dovecot_plain authenticator failed for 6.112.255.173.bc.googleusercontent.com [173.255.112.6]:54050: 535 Incorrect authentication data (set_id=aabdulrahaman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.200.216.246
description:
Jan 28 11:29:33 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.200.216.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 87.236.142.200
description:
[2025-01-28 11:30:05 +0100] info [webmaild] 87.236.142.200 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 86.108.32.122
description:
[2025-01-28 11:30:27 +0100] info [webmaild] 86.108.32.122 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 11:29:52 ait sshd[3583266]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:29:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.21.157
description:
2025-01-28 11:30:36 dovecot_plain authenticator failed for (mail110220.dc.sistemdc.commailtr.com) [78.189.21.157]:40623: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.6.162.163
description:
[2025-01-28 11:30:26 +0100] info [webmaild] 45.6.162.163 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.75.194.34
description:
Jan 28 11:30:47 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.75.194.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.147.125.200
description:
Jan 28 11:30:42 ait sshd[3584028]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.147.125.200 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.147.125.200
description:
Jan 28 11:30:42 ait sshd[3584028]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.147.125.200


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.75.194.34
description:
2025-01-28 11:30:49 dovecot_plain authenticator failed for (34.194.75.138.unknown.m1.com.sg) [138.75.194.34]:40810: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 11:29:52 ait sshd[3583266]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.189.21.157
description:
Jan 28 11:30:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.189.21.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 28 11:31:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.6.81.48
description:
Jan 28 11:31:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.6.81.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.6.81.48
description:
2025-01-28 11:31:41 dovecot_login authenticator failed for (48.81.6.185.in-addr.arpa) [185.6.81.48]:33710: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.95.234
description:
Jan 28 11:31:46 ait sshd[3584479]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.95.234 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.95.234
description:
Jan 28 11:31:46 ait sshd[3584479]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.95.234  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.205.48.62
description:
2025-01-28 11:32:22 dovecot_login authenticator failed for 47-205-48-62.tamp.fl.frontiernet.net [47.205.48.62]:38466: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.228.247
description:
Jan 28 11:31:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.228.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.247
description:
2025-01-28 11:31:53 dovecot_login authenticator failed for (nsg-corporate-247.228.187.122.airtel.in) [122.187.228.247]:47111: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 28 11:31:54 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.231.212.78
description:
Jan 28 11:32:10 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.231.212.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.231.212.78
description:
2025-01-28 11:32:12 dovecot_login authenticator failed for syn-104-231-212-078.res.spectrum.com [104.231.212.78]:62228: 535 Incorrect authentication data (set_id=sales@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.205.48.62
description:
Jan 28 11:32:20 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.205.48.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.182.174.222
description:
Jan 28 11:33:35 ait sshd[3585452]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.182.174.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.182.174.222
description:
Jan 28 11:33:35 ait sshd[3585452]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.182.174.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 11:33:45 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 28 11:33:39 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-28 11:33:41 dovecot_plain authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:51088: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.55.98
description:
Jan 28 11:33:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.55.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 28 11:33:52 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.55.98
description:
2025-01-28 11:33:53 dovecot_plain authenticator failed for ([122.225.55.98]) [122.225.55.98]:53078: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.188
description:
Jan 28 11:34:06 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.188
description:
2025-01-28 11:34:08 dovecot_login authenticator failed for ([111.61.176.188]) [111.61.176.188]:18254: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 28 11:34:41 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-28 11:34:43 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:49710: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.81.242
description:
2025-01-28 11:33:54 dovecot_login authenticator failed for ([58.18.81.242]) [58.18.81.242]:41959: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.190.110.210
description:
Jan 28 11:35:34 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.190.110.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.25
description:
Jan 28 11:34:55 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.194.174.27
description:
2025-01-28 11:35:24 dovecot_plain authenticator failed for ([216.194.174.103]) [216.194.174.27]:43636: 535 Incorrect authentication data (set_id=mawunyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.194.174.27
description:
Jan 28 11:35:22 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 216.194.174.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.25
description:
2025-01-28 11:34:57 dovecot_login authenticator failed for (m121-202-154-25.smartone.com) [121.202.154.25]:28239: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 28 11:35:37 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.190.110.210
description:
2025-01-28 11:35:36 dovecot_plain authenticator failed for ([222.190.110.210]) [222.190.110.210]:33559: 535 Incorrect authentication data (set_id=mawunyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.97
description:
Jan 28 11:36:09 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.97 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.172.173.17
description:
[2025-01-28 11:36:10 +0100] info [webmaild] 201.172.173.17 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.97
description:
2025-01-28 11:36:11 dovecot_plain authenticator failed for ([179.185.1.97]) [179.185.1.97]:60728: 535 Incorrect authentication data (set_id=ads1700155y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.222
description:
Jan 28 11:36:30 ait sshd[3587316]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.240.242.52
description:
[2025-01-28 11:36:32 +0100] info [webmaild] 190.240.242.52 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 154.116.10.206
description:
[2025-01-28 11:36:00 +0100] info [webmaild] 154.116.10.206 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.8.126.222
description:
[2025-01-28 11:36:03 +0100] info [webmaild] 201.8.126.222 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 28 11:36:21 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-28 11:36:23 dovecot_plain authenticator failed for ([103.103.35.130]) [103.103.35.130]:47416: 535 Incorrect authentication data (set_id=ads1700155y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.226
description:
Jan 28 11:36:25 ait sshd[3587295]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.226 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.226
description:
Jan 28 11:36:25 ait sshd[3587295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.226  user=root


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 213.165.95.231
domain: tracker.aitedu.net
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:RubyO||WPU:RubyO||RSV:6.65||T:APACHE||MV:11-35.213.165.95.231


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.62.61.232
description:
[2025-01-28 11:36:00 +0100] info [webmaild] 177.62.61.232 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.222
description:
Jan 28 11:36:30 ait sshd[3587316]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.222  user=root


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.182.174.222
description:
Jan 28 11:37:03 ait sshd[3587792]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.182.174.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 28 11:37:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.236.127.26
description:
[2025-01-28 11:37:49 +0100] info [webmaild] 37.236.127.26 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 28 11:37:32 ait sshd[3587918]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-28 11:37:45 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:40288: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.182.174.222
description:
Jan 28 11:37:03 ait sshd[3587792]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.182.174.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 11:37:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 28 11:37:32 ait sshd[3587918]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 189.89.135.156
description:
[2025-01-28 11:37:07 +0100] info [webmaild] 189.89.135.156 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.93
description:
Jan 28 11:37:30 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.93 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Jan 28 11:37:36 ait sshd[3588066]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.80.117.14
description:
[2025-01-28 11:37:45 +0100] info [webmaild] 41.80.117.14 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 28 11:36:50 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.121.252.98
description:
[2025-01-28 11:36:54 +0100] info [webmaild] 138.121.252.98 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.93
description:
2025-01-28 11:37:32 dovecot_login authenticator failed for ([104.241.230.93]) [104.241.230.93]:49161: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.218
description:
Jan 28 11:37:36 ait sshd[3588066]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.199.59.96
description:
[2025-01-28 11:37:59 +0100] info [webmaild] 181.199.59.96 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.203.87.228
description:
Jan 28 11:38:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.203.87.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.203.87.228
description:
2025-01-28 11:38:03 dovecot_login authenticator failed for s2.legionusa.com [159.203.87.228]:44844: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13008
name: Mail Reciepient rejected
abuser: 165.154.251.134
description:
2025-01-28 11:38:34 H=(mail.ait-edu.us) [165.154.251.134]:50960 F=<vibbgghckbk@ait-edu.us> rejected RCPT <validxxxg@gmail.com>: Sender verify failed


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.218
description:
Jan 28 11:37:53 ait sshd[3588133]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.218 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 94.182.174.222
description:
Jan 28 11:38:24 ait sshd[3588358]: Failed password for invalid user fred from 94.182.174.222 port 38520 ssh2


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.218
description:
Jan 28 11:37:53 ait sshd[3588133]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.218  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 28 11:38:36 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 28 11:38:40 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-28 11:38:42 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:39612: 535 Incorrect authentication data (set_id=info@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.222.237.145
description:
2025-01-28 11:38:18 dovecot_login authenticator failed for (static.bb.ill.59.92.234.29.bsnl.in) [106.222.237.145]:32509: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.182.174.222
description:
Jan 28 11:38:22 ait sshd[3588358]: pam_imunify(sshd:auth): [IM360_RBL] The IP 94.182.174.222 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 94.182.174.222
description:
Jan 28 11:38:22 ait sshd[3588358]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=94.182.174.222


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 28 11:38:25 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.141
description:
Jan 28 11:39:00 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.236
description:
Jan 28 11:39:38 ait sshd[3589248]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.200.70.134
description:
2025-01-28 11:39:45 dovecot_plain authenticator failed for 42-200-70-134.static.imsbiz.com [42.200.70.134]:33426: 535 Incorrect authentication data (set_id=jobs)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.200.70.134
description:
Jan 28 11:39:43 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.200.70.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.80.34.94
description:
[2025-01-28 11:39:38 +0100] info [webmaild] 170.80.34.94 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 157.245.202.151
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:||WPU:||RSV:6.65||T:APACHE||MV:11-39.157.245.202.151


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 28 11:39:32 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.236
description:
Jan 28 11:39:38 ait sshd[3589248]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.236  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.141
description:
2025-01-28 11:39:02 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:42903: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-28 11:39:34 dovecot_plain authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:34936: 535 Incorrect authentication data (set_id=jobs@jaster.us)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.0.236
description:
Jan 28 11:39:52 ait sshd[3589296]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.92.0.236 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.92.0.236
description:
Jan 28 11:39:52 ait sshd[3589296]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.92.0.236  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.121.73.117
description:
2025-01-28 11:40:03 dovecot_plain authenticator failed for ([24.121.73.117]) [24.121.73.117]:48321: 535 Incorrect authentication data (set_id=ads14b00350y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 28 11:40:48 ait sshd[3590136]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=gvu


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.157.201.179
description:
[2025-01-28 11:39:58 +0100] info [webmaild] 177.157.201.179 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.149.215
description:
[2025-01-28 11:40:29 +0100] info [webmaild] 177.37.149.215 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.188.242
description:
2025-01-28 11:39:53 dovecot_plain authenticator failed for ([115.75.188.242]) [115.75.188.242]:42408: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.121.73.117
description:
Jan 28 11:40:01 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.121.73.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 28 11:40:48 ait sshd[3590136]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.75.188.242
description:
Jan 28 11:39:51 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.75.188.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.2.79
description:
Jan 28 11:40:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.2.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.40.62.151
description:
Jan 28 11:40:59 ait auth[3471527]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.40.62.151 has been locked due to Imunify RBL


