# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.1.117.226
description:
Jan 31 03:56:42 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.1.117.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.79.201.80
description:
[2025-01-31 03:57:22 +0100] info [webmaild] 170.79.201.80 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.81.242
description:
Jan 31 03:56:57 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.81.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.64.70
description:
[2025-01-31 03:56:36 +0100] info [webmaild] 157.100.64.70 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.79.83.28
description:
2025-01-31 03:57:41 dovecot_plain authenticator failed for ([38.79.83.28]) [38.79.83.28]:53240: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 193.32.162.132
description:
Jan 31 03:57:44 ait sshd[1326264]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=193.32.162.132


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
description:
2025-01-31 03:57:50 dovecot_plain authenticator failed for ([14.43.137.90]) [14.43.137.90]:52688: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 31 03:57:36 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.79.83.28
description:
Jan 31 03:57:39 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.79.83.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.32.162.132
description:
Jan 31 03:57:44 ait sshd[1326264]: pam_imunify(sshd:auth): [IM360_RBL] The IP 193.32.162.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 03:58:21 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 03:57:48 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.43.137.90
description:
Jan 31 03:57:48 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.43.137.90 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.106.81
description:
Jan 31 03:57:50 ait sshd[1326282]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.106.81


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.245.109.37
description:
Jan 31 03:57:27 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.245.109.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.245.109.37
description:
2025-01-31 03:57:29 dovecot_plain authenticator failed for ([103.245.109.37]) [103.245.109.37]:39488: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-31 03:57:38 dovecot_plain authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:35660: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.253
description:
2025-01-31 03:59:09 dovecot_plain authenticator failed for ([167.250.119.253]) [167.250.119.253]:34563: 535 Incorrect authentication data (set_id=ads80a99909y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 03:59:23 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.180.2.62
description:
Jan 31 03:59:04 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.180.2.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.80.46.250
description:
2025-01-31 03:58:40 dovecot_plain authenticator failed for ([189.80.46.250]) [189.80.46.250]:57844: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.222.38.9
description:
Jan 31 03:59:00 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.222.38.9 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.222.38.9
description:
2025-01-31 03:59:02 dovecot_plain authenticator failed for (scz-177-222-38-00009.tigo.bo) [177.222.38.9]:50988: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.180.2.62
description:
2025-01-31 03:59:06 dovecot_plain authenticator failed for ([222.180.2.62]) [222.180.2.62]:56430: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.187.213.29
description:
Jan 31 03:59:11 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.187.213.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.163.184.77
description:
Jan 31 03:58:28 ait sshd[1326511]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.163.184.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.148.216.117
description:
Jan 31 03:58:42 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.148.216.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.216.117
description:
2025-01-31 03:58:44 dovecot_plain authenticator failed for ([103.148.216.98]) [103.148.216.117]:54698: 535 Incorrect authentication data (set_id=ads80a99909y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.119.253
description:
Jan 31 03:59:07 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.119.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.80.46.250
description:
Jan 31 03:58:38 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.80.46.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 197.15.33.48
description:
[2025-01-31 03:58:38 +0100] info [webmaild] 197.15.33.48 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
description:
2025-01-31 03:59:13 dovecot_plain authenticator failed for (made-again.tmesis.com) [24.187.213.29]:48334: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.163.184.77
description:
Jan 31 03:58:28 ait sshd[1326511]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.163.184.77


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.78.202
description:
[2025-01-31 03:59:30 +0100] info [webmaild] 84.54.78.202 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.71.207
description:
2025-01-31 03:59:39 dovecot_plain authenticator failed for ([151.83.71.207]) [151.83.71.207]:49982: 535 Incorrect authentication data (set_id=ads19a00027y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.197.186.179
description:
Jan 31 03:59:53 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.197.186.179 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 213.230.74.63
description:
[2025-01-31 04:00:18 +0100] info [webmaild] 213.230.74.63 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.83.71.207
description:
Jan 31 03:59:37 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.83.71.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.197.186.179
description:
2025-01-31 03:59:55 dovecot_plain authenticator failed for ([120.197.186.179]) [120.197.186.179]:33200: 535 Incorrect authentication data (set_id=ads19a00027y)


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.126.3
description:
47.128.126.3 - - [31/Jan/2025:04:00:16 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12477052 HTTP/2.0" 302 0 lms.aitsmartschool.com "https://lms.aitsmartschool.com/courses/page/8/?filter_course-language=99&filtering=1&instructor=2" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.126.3


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.9.211
description:
Jan 31 03:59:55 ait sshd[1326881]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.9.211 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.9.211
description:
Jan 31 03:59:55 ait sshd[1326881]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.9.211


plugin: ossec
rule: 31129
name: Anti-bot protection. Grouped messages
abuser: 47.128.114.184
description:
47.128.114.184 - - [31/Jan/2025:04:00:46 +0100] "GET /wp-content/plugins/buddypress/bp-members/css/blocks/dynamic-members.min.css HTTP/2.0" 200 1440 lms.aitsmartschool.com "https://lms.aitsmartschool.com/z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=29784098" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"1" PEER:47.128.114.184


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.37.19.125
description:
[2025-01-31 04:01:10 +0100] info [webmaild] 191.37.19.125 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.116.226
description:
Jan 31 04:01:13 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.116.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.116.226
description:
2025-01-31 04:01:15 dovecot_plain authenticator failed for ([117.176.116.226]) [117.176.116.226]:47518: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.251
description:
Jan 31 04:02:17 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.251
description:
2025-01-31 04:02:19 dovecot_plain authenticator failed for ([211.247.127.251]) [211.247.127.251]:37210: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.125.64.126
description:
2025-01-31 04:01:29 dovecot_plain authenticator failed for 126.64.125.78.rev.sfr.net [78.125.64.126]:41408: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.125.64.126
description:
Jan 31 04:01:27 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.125.64.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.180.88.72
description:
2025-01-31 04:02:01 dovecot_plain authenticator failed for static-47-180-88-72.lsan.ca.frontiernet.net ([65.255.196.42]) [47.180.88.72]:60522: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.70.9.114
description:
2025-01-31 04:02:05 dovecot_plain authenticator failed for ([218.70.9.114]) [218.70.9.114]:46568: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.180.88.72
description:
Jan 31 04:01:59 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.180.88.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.70.9.114
description:
Jan 31 04:02:03 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.70.9.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.34.106.146
description:
Jan 31 04:03:45 ait sshd[1328862]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.34.106.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.160.119.116
description:
2025-01-31 04:04:10 dovecot_plain authenticator failed for ([61.160.119.116]) [61.160.119.116]:51622: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.160.119.116
description:
Jan 31 04:04:08 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.160.119.116 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 194.163.184.77
description:
Jan 31 04:04:09 ait sshd[1328927]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=194.163.184.77


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 194.163.184.77
description:
Jan 31 04:04:11 ait sshd[1328927]: Failed password for invalid user admin from 194.163.184.77 port 50000 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-31 04:03:49 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:48157: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.34.106.146
description:
Jan 31 04:03:45 ait sshd[1328862]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 84.54.70.190
description:
[2025-01-31 04:03:32 +0100] info [webmaild] 84.54.70.190 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-31 04:04:05 dovecot_plain authenticator failed for ([27.71.26.64]) [27.71.26.64]:48391: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.163.184.77
description:
Jan 31 04:04:09 ait sshd[1328927]: pam_imunify(sshd:auth): [IM360_RBL] The IP 194.163.184.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-01-31 04:03:45 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net (eucancenel) [69.124.10.62]:38720: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 31 04:03:47 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Jan 31 04:03:43 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 31 04:04:03 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.46.9.149
description:
[2025-01-31 04:04:15 +0100] info [webmaild] 181.46.9.149 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.208.127.51
description:
[2025-01-31 04:05:01 +0100] info [webmaild] 143.208.127.51 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 83.142.52.29
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads20a00243y@ait.edu.gh||WPU:ads20a00243y@ait.edu.gh||RSV:6.65||T:APACHE||MV:04-04.83.142.52.29


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
description:
2025-01-31 04:04:37 dovecot_plain authenticator failed for ([36.39.140.2]) [36.39.140.2]:36506: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-04.80.76.51.123


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.37.179.158
description:
Jan 31 04:04:46 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.37.179.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 04:05:19 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.171.137.226
description:
2025-01-31 04:04:27 dovecot_plain authenticator failed for ([60.171.137.226]) [60.171.137.226]:50919: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
description:
Jan 31 04:04:57 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.95
description:
Jan 31 04:05:04 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.95
description:
2025-01-31 04:05:06 dovecot_plain authenticator failed for (95-179-53-194.mairnet.net) [194.53.179.95]:34844: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.39.140.2
description:
Jan 31 04:04:35 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.39.140.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.179.158
description:
2025-01-31 04:04:48 dovecot_plain authenticator failed for broadband-77-37-179-158.ip.moscow.rt.ru [77.37.179.158]:60996: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.212.0.131
description:
Jan 31 04:05:27 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.212.0.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.0.131
description:
2025-01-31 04:05:29 dovecot_plain authenticator failed for ([123.212.0.131]) [123.212.0.131]:41378: 535 Incorrect authentication data (set_id=edonkor)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.246.42
description:
Jan 31 04:05:31 ait sshd[1329551]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.150.246.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 31 04:06:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-31 04:06:03 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:50354: 535 Incorrect authentication data (set_id=ads18b00134y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.166.70.166
description:
2025-01-31 04:05:49 dovecot_plain authenticator failed for (samptuse) [109.166.70.166]:52803: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.34.106.146
description:
Jan 31 04:05:52 ait sshd[1329743]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.34.106.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.115.93.183
description:
Jan 31 04:06:17 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.115.93.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.115.93.183
description:
2025-01-31 04:06:19 dovecot_plain authenticator failed for ([189.115.93.183]) [189.115.93.183]:58322: 535 Incorrect authentication data (set_id=ads18b00134y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.166.70.166
description:
Jan 31 04:05:47 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.166.70.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.150.246.42
description:
Jan 31 04:05:31 ait sshd[1329551]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.150.246.42


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.34.106.146
description:
Jan 31 04:05:52 ait sshd[1329743]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 04:05:56 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.49.167.162
description:
Jan 31 04:06:57 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.49.167.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.49.167.162
description:
2025-01-31 04:06:59 dovecot_plain authenticator failed for (l49-167-162.novotelecom.ru) [178.49.167.162]:55056: 535 Incorrect authentication data (set_id=ads17b00137y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.34.106.146
description:
Jan 31 04:07:14 ait sshd[1330140]: pam_imunify(sshd:auth): [IM360_RBL] The IP 114.34.106.146 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 114.34.106.146
description:
Jan 31 04:07:14 ait sshd[1330140]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=114.34.106.146


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.30.191.129
description:
Jan 31 04:06:48 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.30.191.129 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 04:06:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 41.158.190.72
description:
[2025-01-31 04:06:38 +0100] info [webmaild] 41.158.190.72 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.191.129
description:
2025-01-31 04:06:50 dovecot_plain authenticator failed for ([5.30.191.129]) [5.30.191.129]:43382: 535 Incorrect authentication data (set_id=ads17b00137y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.234.170.102
description:
2025-01-31 04:07:58 dovecot_plain authenticator failed for ([183.234.170.102]) [183.234.170.102]:41286: 535 Incorrect authentication data (set_id=ads18a00007y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.9.38.92
description:
Jan 31 04:08:06 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.9.38.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.38.92
description:
2025-01-31 04:08:08 dovecot_plain authenticator failed for ([59.9.38.92]) [59.9.38.92]:47780: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.47.8.72
description:
[2025-01-31 04:08:08 +0100] info [webmaild] 186.47.8.72 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 31 04:07:29 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.251.121.138
description:
[2025-01-31 04:07:29 +0100] info [webmaild] 186.251.121.138 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-31 04:07:31 dovecot_plain authenticator failed for ([182.42.113.10]) [182.42.113.10]:49122: 535 Incorrect authentication data (set_id=ads18a00007y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.234.170.102
description:
Jan 31 04:07:56 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.234.170.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
description:
2025-01-31 04:09:09 dovecot_plain authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:46657: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.85.12.142
description:
2025-01-31 04:08:34 dovecot_plain authenticator failed for ([61.85.12.142]) [61.85.12.142]:40875: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.102.66.226
description:
Jan 31 04:08:53 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.102.66.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
description:
2025-01-31 04:08:54 dovecot_plain authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:49232: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.106.81
description:
Jan 31 04:09:12 ait sshd[1330702]: pam_imunify(sshd:auth): [IM360_RBL] The IP 139.59.106.81 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.9.211
description:
Jan 31 04:09:23 ait sshd[1330742]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.9.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.243.136.120
description:
2025-01-31 04:08:44 dovecot_plain authenticator failed for ([114.243.136.120]) [114.243.136.120]:60351: 535 Incorrect authentication data (set_id=ads21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.16.135
description:
Jan 31 04:08:50 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.16.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.16.135
description:
2025-01-31 04:08:52 dovecot_plain authenticator failed for ([5.31.16.135]) [5.31.16.135]:46880: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.15.231.237
description:
[2025-01-31 04:08:42 +0100] info [webmaild] 179.15.231.237 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.151.136
description:
Jan 31 04:08:52 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.151.136 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.102.66.226
description:
2025-01-31 04:08:55 dovecot_plain authenticator failed for ([207.102.66.226]) [207.102.66.226]:50893: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 139.59.106.81
description:
Jan 31 04:09:12 ait sshd[1330702]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.106.81  user=operator


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.9.211
description:
Jan 31 04:09:23 ait sshd[1330742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.9.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.56.31.167
description:
2025-01-31 04:08:28 dovecot_plain authenticator failed for p5b381fa7.dip0.t-ipconnect.de (unbewa) [91.56.31.167]:65032: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.85.12.142
description:
Jan 31 04:08:32 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.85.12.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.243.136.120
description:
Jan 31 04:08:42 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.243.136.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.182
description:
Jan 31 04:09:07 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.56.31.167
description:
Jan 31 04:08:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.56.31.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.220.135.93
description:
Jan 31 04:08:41 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.220.135.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.220.135.93
description:
2025-01-31 04:08:43 dovecot_plain authenticator failed for 93.135.220.111.sta.wbroadband.net.au [111.220.135.93]:56488: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 04:09:45 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.57.154.146
description:
Jan 31 04:09:54 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.57.154.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.89.234
description:
2025-01-31 04:09:42 dovecot_plain authenticator failed for ([187.12.89.234]) [187.12.89.234]:36526: 535 Incorrect authentication data (set_id=eejour13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.89.234
description:
Jan 31 04:09:40 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.89.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.57.154.146
description:
2025-01-31 04:09:56 dovecot_plain authenticator failed for ([58.57.154.146]) [58.57.154.146]:53842: 535 Incorrect authentication data (set_id=eejour13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.132.226
description:
Jan 31 04:10:10 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.132.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.234.132.226
description:
2025-01-31 04:10:12 dovecot_plain authenticator failed for ([91.234.132.226]) [91.234.132.226]:41576: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.178.14.146
description:
[2025-01-31 04:10:20 +0100] info [webmaild] 45.178.14.146 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 14.103.9.211
description:
Jan 31 04:09:25 ait sshd[1330742]: Failed password for invalid user admin from 14.103.9.211 port 38772 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 198.54.106.83
description:
Jan 31 04:10:31 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 198.54.106.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.106.31.52
description:
2025-01-31 04:10:32 dovecot_plain authenticator failed for 131-106-31-52.s1842.c3-0.eas-cbr5.atw-eas.pa.cable.rcncustomer.com [131.106.31.52]:56452: 535 Incorrect authentication data (set_id=stquarshie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.13
description:
2025-01-31 04:10:44 dovecot_plain authenticator failed for ([41.216.169.13]) [41.216.169.13]:49284: 535 Incorrect authentication data (set_id=stquarshie)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.150.246.42
description:
Jan 31 04:10:49 ait sshd[1331552]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.150.246.42


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.103.9.211
description:
Jan 31 04:11:08 ait sshd[1331626]: pam_imunify(sshd:auth): [IM360_RBL] The IP 14.103.9.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.106.31.52
description:
Jan 31 04:10:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.106.31.52 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.139.18.119
description:
[2025-01-31 04:11:13 +0100] info [webmaild] 177.139.18.119 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.13
description:
Jan 31 04:10:42 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.246.42
description:
Jan 31 04:10:49 ait sshd[1331552]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.150.246.42 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 14.103.9.211
description:
Jan 31 04:11:08 ait sshd[1331626]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=14.103.9.211


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 198.54.106.83
description:
2025-01-31 04:10:33 dovecot_plain authenticator failed for 83.106.54.198.in-addr.arpa [198.54.106.83]:52624: 535 Incorrect authentication data (set_id=abs22a00002y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.202.224
description:
2025-01-31 04:12:25 dovecot_plain authenticator failed for ([196.46.202.224]) [196.46.202.224]:51287: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.45.59.86
description:
[2025-01-31 04:11:27 +0100] info [webmaild] 187.45.59.86 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 31 04:12:09 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-31 04:12:12 dovecot_plain authenticator failed for (189-56-79-105.customer.tdatabrasil.net.br) [186.200.249.162]:53727: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.129.231.11
description:
[2025-01-31 04:12:14 +0100] info [webmaild] 177.129.231.11 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 31 04:12:10 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-31 04:12:11 dovecot_plain authenticator failed for ([59.2.141.155]) [59.2.141.155]:47822: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.202.224
description:
Jan 31 04:12:23 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.202.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 04:12:50 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.116.226
description:
Jan 31 04:13:16 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.116.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.246.42
description:
Jan 31 04:13:18 ait sshd[1332247]: pam_imunify(sshd:auth): [IM360_RBL] The IP 218.150.246.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 31 04:12:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-01-31 04:12:42 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:37099: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
description:
2025-01-31 04:12:45 dovecot_plain authenticator failed for ([196.191.142.67]) [196.191.142.67]:51580: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.175.220.250
description:
Jan 31 04:12:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.175.220.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.191.142.67
description:
Jan 31 04:12:43 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.191.142.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-31 04:13:02 dovecot_plain authenticator failed for ([61.81.151.97]) [61.81.151.97]:32944: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.102.48.253
description:
2025-01-31 04:13:11 dovecot_plain authenticator failed for ([112.102.48.253]) [112.102.48.253]:60999: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.84.34.85
description:
2025-01-31 04:12:34 dovecot_plain authenticator failed for (ppp075.bol-online.com) [202.84.34.85]:37066: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 04:12:47 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 31 04:13:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.150.246.42
description:
Jan 31 04:13:18 ait sshd[1332247]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.150.246.42


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.116.226
description:
2025-01-31 04:13:18 dovecot_plain authenticator failed for ([117.176.116.226]) [117.176.116.226]:38932: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.84.34.85
description:
Jan 31 04:12:32 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.84.34.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Jan 31 04:12:40 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.221.64.10
description:
2025-01-31 04:13:08 dovecot_plain authenticator failed for ([102.221.64.10]) [102.221.64.10]:57377: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.102.48.253
description:
Jan 31 04:13:09 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.102.48.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.175.220.250
description:
2025-01-31 04:12:32 dovecot_plain authenticator failed for 110-175-220-250.static.tpgi.com.au (60-242-84-9.static.tpgi.com.au) [110.175.220.250]:49238: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.236
description:
2025-01-31 04:13:06 dovecot_plain authenticator failed for ([171.244.40.228]) [171.244.40.236]:60114: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 218.150.246.42
description:
Jan 31 04:13:20 ait sshd[1332247]: Failed password for invalid user ftpuser from 218.150.246.42 port 42706 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 31 04:13:00 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-31 04:13:16 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:38074: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.74.186.57
description:
2025-01-31 04:13:28 dovecot_plain authenticator failed for ([91.74.186.57]) [91.74.186.57]:39409: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 198.163.195.101
description:
[2025-01-31 04:13:57 +0100] info [webmaild] 198.163.195.101 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.74.186.57
description:
Jan 31 04:13:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.74.186.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.76.194.159
description:
Jan 31 04:14:40 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.76.194.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.81.14.113
description:
Jan 31 04:15:11 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.81.14.113 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.109.30.49
description:
[2025-01-31 04:15:16 +0100] info [webmaild] 187.109.30.49 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.222.57.190
description:
Jan 31 04:14:31 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.222.57.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.158.248.248
description:
Jan 31 04:14:41 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.158.248.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.76.194.159
description:
2025-01-31 04:14:42 dovecot_plain authenticator failed for pool-72-76-194-159.nwrknj.fios.verizon.net [72.76.194.159]:54522: 535 Incorrect authentication data (set_id=yeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.66.222
description:
Jan 31 04:14:45 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.66.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 31 04:15:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.75.68.16
description:
2025-01-31 04:15:00 dovecot_plain authenticator failed for ([27.75.68.16]) [27.75.68.16]:40898: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-31 04:15:03 dovecot_plain authenticator failed for ([80.82.54.138]) [81.211.77.58]:58843: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.57.190
description:
2025-01-31 04:14:33 dovecot_plain authenticator failed for ([195.222.57.190]) [195.222.57.190]:54976: 535 Incorrect authentication data (set_id=ads21b00220y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.66.222
description:
2025-01-31 04:14:47 dovecot_plain authenticator failed for ([31.173.66.222]) [31.173.66.222]:43500: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.84.197.105
description:
[2025-01-31 04:14:55 +0100] info [webmaild] 170.84.197.105 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.81.14.113
description:
2025-01-31 04:15:13 dovecot_plain authenticator failed for ([170.81.14.113]) [170.81.14.113]:57186: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.158.248.248
description:
2025-01-31 04:14:43 dovecot_plain authenticator failed for ([193.158.248.248]) [193.158.248.248]:32884: 535 Incorrect authentication data (set_id=ads21b00220y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.0.247.34
description:
[2025-01-31 04:14:50 +0100] info [webmaild] 190.0.247.34 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.45.217.249
description:
Jan 31 04:14:54 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.45.217.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
description:
2025-01-31 04:14:56 dovecot_plain authenticator failed for ([14.45.217.249]) [14.45.217.249]:41516: 535 Incorrect authentication data (set_id=yeboah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.75.68.16
description:
Jan 31 04:14:58 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.75.68.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-01-31 04:16:16 dovecot_plain authenticator failed for ([78.134.19.99]) [78.134.19.99]:35211: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.58
description:
Jan 31 04:16:05 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.1.82
description:
Jan 31 04:15:50 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.1.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.136.167
description:
2025-01-31 04:16:03 dovecot_plain authenticator failed for ([2.58.136.167]) [2.58.136.167]:2665: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 31 04:16:04 ait sshd[1333633]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.58
description:
2025-01-31 04:16:07 dovecot_plain authenticator failed for ([178.178.222.58]) [178.178.222.58]:36904: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 193.163.92.175
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads18a00007y@ait.edu.gh||WPU:ads18a00007y@ait.edu.gh||RSV:6.65||T:APACHE||MV:04-15.193.163.92.175


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.39.123.209
description:
[2025-01-31 04:16:04 +0100] info [webmaild] 177.39.123.209 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Jan 31 04:16:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 04:16:18 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.1.82
description:
2025-01-31 04:15:52 dovecot_plain authenticator failed for ([183.249.1.82]) [183.249.1.82]:50025: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.58.136.167
description:
Jan 31 04:16:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.58.136.167 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 31 04:16:04 ait sshd[1333633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.19.228
description:
Jan 31 04:16:38 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.19.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.19.228
description:
2025-01-31 04:16:40 dovecot_plain authenticator failed for ([57.128.19.228]) [57.128.19.228]:56632: 535 Incorrect authentication data (set_id=dzidonu@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.67.123.202
description:
2025-01-31 04:17:09 dovecot_plain authenticator failed for ([218.67.123.202]) [218.67.123.202]:44507: 535 Incorrect authentication data (set_id=dzidonu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.36.238.213
description:
2025-01-31 04:17:25 dovecot_plain authenticator failed for ip213.ip-54-36-238.eu [54.36.238.213]:42366: 535 Incorrect authentication data (set_id=ads22b00295y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.238.213
description:
Jan 31 04:17:23 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.238.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.67.123.202
description:
Jan 31 04:17:07 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.67.123.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.115.229.202
description:
Jan 31 04:17:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.115.229.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.115.229.202
description:
2025-01-31 04:17:16 dovecot_plain authenticator failed for ([124.115.229.202]) [124.115.229.202]:43828: 535 Incorrect authentication data (set_id=ads22b00295y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.6.120.72
description:
2025-01-31 04:18:01 dovecot_plain authenticator failed for ([112.6.120.72]) [112.6.120.72]:34771: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.63.170
description:
2025-01-31 04:18:03 dovecot_plain authenticator failed for ([171.244.63.170]) [171.244.63.170]:64397: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.15.251.33
description:
Jan 31 04:18:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.15.251.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.234.104.42
description:
2025-01-31 04:17:41 dovecot_plain authenticator failed for ([218.234.104.42]) [218.234.104.42]:50081: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.112.103.145
description:
[2025-01-31 04:17:56 +0100] info [webmaild] 190.112.103.145 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.6.120.72
description:
Jan 31 04:17:59 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.6.120.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.244.63.170
description:
Jan 31 04:18:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.244.63.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.15.251.33
description:
2025-01-31 04:18:16 dovecot_plain authenticator failed for ([59.15.251.33]) [59.15.251.33]:42304: 535 Incorrect authentication data (set_id=rfiawoo13)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.234.104.42
description:
Jan 31 04:17:39 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.234.104.42 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 80.76.51.123
domain: phd.ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:04-17.80.76.51.123


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.221.120.199
description:
[2025-01-31 04:18:52 +0100] info [webmaild] 177.221.120.199 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.70
description:
Jan 31 04:19:14 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.70
description:
2025-01-31 04:19:16 dovecot_plain authenticator failed for ([185.167.56.70]) [185.167.56.70]:40784: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.14.24.50
description:
Jan 31 04:19:10 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.14.24.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.14.24.50
description:
2025-01-31 04:19:12 dovecot_plain authenticator failed for 50.24.14.46.static.wline.lns.sme.cust.swisscom.ch [46.14.24.50]:61531: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.179.95
description:
Jan 31 04:18:56 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.179.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.179.95
description:
2025-01-31 04:18:58 dovecot_plain authenticator failed for ([194.53.179.95]) [194.53.179.95]:37946: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.114.98.162
description:
[2025-01-31 04:19:08 +0100] info [webmaild] 103.114.98.162 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.223.58
description:
Jan 31 04:20:21 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.223.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.223.58
description:
2025-01-31 04:20:23 dovecot_plain authenticator failed for net-2-37-223-58.cust.vodafonedsl.it [2.37.223.58]:45430: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.140.24.7
description:
[2025-01-31 04:19:56 +0100] info [webmaild] 103.140.24.7 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.27.81
description:
Jan 31 04:19:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.27.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.27.81
description:
2025-01-31 04:19:32 dovecot_plain authenticator failed for ([27.71.27.81]) [27.71.27.81]:24370: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.225.185.148
description:
Jan 31 04:20:37 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.225.185.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.115.53.66
description:
Jan 31 04:21:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.115.53.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.146.217.105
description:
2025-01-31 04:20:55 dovecot_plain authenticator failed for 105.217.146.34.bc.googleusercontent.com [34.146.217.105]:53174: 535 Incorrect authentication data (set_id=tyeboah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.115.53.66
description:
2025-01-31 04:21:03 dovecot_plain authenticator failed for ([58.115.53.66]) [58.115.53.66]:48677: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.178
description:
2025-01-31 04:21:15 dovecot_plain authenticator failed for ([185.255.212.178]) [185.255.212.178]:30919: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.34.165.114
description:
Jan 31 04:20:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.34.165.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.225.185.148
description:
2025-01-31 04:20:39 dovecot_plain authenticator failed for ([124.225.185.148]) [124.225.185.148]:51122: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.146.217.105
description:
Jan 31 04:20:53 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.146.217.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 04:21:13 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.191.97
description:
Jan 31 04:21:16 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.191.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.165.114
description:
2025-01-31 04:20:32 dovecot_plain authenticator failed for (136-34-165-114.googlefiber.net) [136.34.165.114]:35576: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.178
description:
Jan 31 04:21:13 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.178 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.97
description:
2025-01-31 04:21:18 dovecot_plain authenticator failed for ([65.20.191.97]) [65.20.191.97]:33110: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.169.6.99
description:
Jan 31 04:21:48 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.169.6.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
description:
2025-01-31 04:21:49 dovecot_plain authenticator failed for 48.211.41.34.bc.googleusercontent.com [34.41.211.48]:60140: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 39.62.136.178
description:
[2025-01-31 04:21:52 +0100] info [cpaneld] 39.62.136.178 - ait002 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.246.6.133
description:
2025-01-31 04:22:02 dovecot_plain authenticator failed for ([106.246.6.133]) [106.246.6.133]:43928: 535 Incorrect authentication data (set_id=eng19a00005y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.45.217.249
description:
2025-01-31 04:21:33 dovecot_plain authenticator failed for ([14.45.217.249]) [14.45.217.249]:46172: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 34.41.211.48
description:
Jan 31 04:21:47 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 34.41.211.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.235.228
description:
Jan 31 04:21:58 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.235.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.6.133
description:
Jan 31 04:22:00 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.6.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.235.228
description:
2025-01-31 04:22:00 dovecot_login authenticator failed for ([127.0.0.1]) [92.118.235.228]:51654: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.198.146.65
description:
2025-01-31 04:21:43 dovecot_login authenticator failed for 6dc69241.rev.dansknet.dk ([127.0.0.1]) [109.198.146.65]:40287: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.189.61.189
description:
2025-01-31 04:22:23 dovecot_plain authenticator failed for (181-189-61-189.ndtelecompb.com.br) [181.189.61.189]:34512: 535 Incorrect authentication data (set_id=abs1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 04:21:27 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.45.217.249
description:
Jan 31 04:21:31 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.45.217.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.198.146.65
description:
Jan 31 04:21:41 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.198.146.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.169.6.99
description:
2025-01-31 04:21:50 dovecot_plain authenticator failed for ([61.169.6.99]) [61.169.6.99]:34614: 535 Incorrect authentication data (set_id=abs1@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.63.107.83
description:
[2025-01-31 04:21:56 +0100] info [webmaild] 200.63.107.83 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.189.61.189
description:
Jan 31 04:22:21 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.189.61.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.233.4.50
description:
Jan 31 04:22:26 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.233.4.50 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 157.100.143.169
description:
[2025-01-31 04:22:48 +0100] info [webmaild] 157.100.143.169 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.76.69.221
description:
Jan 31 04:23:18 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.76.69.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.237.42.54
description:
2025-01-31 04:22:52 dovecot_plain authenticator failed for ([83.237.42.54]) [83.237.42.54]:36058: 535 Incorrect authentication data (set_id=assdas1@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 31 04:23:01 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.76.69.221
description:
2025-01-31 04:23:20 dovecot_login authenticator failed for (wcdma.178-76-69-221.moldcell.md) [178.76.69.221]:59012: 535 Incorrect authentication data (set_id=grahamyvirg)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.32.73.141
description:
Jan 31 04:22:35 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.32.73.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 04:22:44 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-31 04:23:03 dovecot_plain authenticator failed for ([147.235.97.158]) [147.235.97.158]:62659: 535 Incorrect authentication data (set_id=assdas1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.35.63.27
description:
Jan 31 04:23:11 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.35.63.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.233.4.50
description:
2025-01-31 04:22:28 dovecot_plain authenticator failed for ([61.233.4.50]) [61.233.4.50]:44020: 535 Incorrect authentication data (set_id=eng19a00005y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 47.76.51.147
description:
Jan 31 04:22:49 ait sshd[1335813]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=47.76.51.147  user=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.67.210.71
description:
[2025-01-31 04:22:49 +0100] info [webmaild] 187.67.210.71 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.237.42.54
description:
Jan 31 04:22:50 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.237.42.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.35.63.27
description:
2025-01-31 04:23:13 dovecot_login authenticator failed for ([110.35.63.27]) [110.35.63.27]:58500: 535 Incorrect authentication data (set_id=grahamyvirg@jaster.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.76.174.254
description:
Jan 31 04:23:31 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.76.174.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 31 04:23:39 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.137.30
description:
2025-01-31 04:24:07 dovecot_plain authenticator failed for ([1.237.137.30]) [1.237.137.30]:50008: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 31 04:23:30 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Jan 31 04:23:35 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.237.137.30
description:
Jan 31 04:24:05 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.237.137.30 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 212.39.117.238
description:
[2025-01-31 04:23:35 +0100] info [webmaild] 212.39.117.238 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.163.122.138
description:
Jan 31 04:23:47 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.163.122.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.122.138
description:
2025-01-31 04:23:49 dovecot_plain authenticator failed for (abts-north-static-x.138.122.163.122.airtelbroadband.in) [122.163.122.138]:51084: 535 Incorrect authentication data (set_id=ads21b00192y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.76.174.254
description:
2025-01-31 04:23:33 dovecot_plain authenticator failed for (18776174254.telemar.net.br) [187.76.174.254]:53564: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-01-31 04:23:37 dovecot_plain authenticator failed for ([36.135.125.196]) [36.135.125.196]:41418: 535 Incorrect authentication data (set_id=ads21b00192y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-31 04:23:41 dovecot_plain authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:53802: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.199.29.111
description:
Jan 31 04:23:52 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.199.29.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.199.29.111
description:
2025-01-31 04:23:54 dovecot_plain authenticator failed for ([124.199.29.111]) [124.199.29.111]:55522: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.204.158.2
description:
2025-01-31 04:24:40 dovecot_plain authenticator failed for 2.189-204-158.bestelclientes.com.mx [189.204.158.2]:27568: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.70.120.127
description:
Jan 31 04:24:28 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.70.120.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.70.120.127
description:
2025-01-31 04:24:30 dovecot_plain authenticator failed for ([182.70.120.127]) [182.70.120.127]:56428: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.204.158.2
description:
Jan 31 04:24:38 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.204.158.2 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 191.242.53.148
description:
[2025-01-31 04:25:30 +0100] info [webmaild] 191.242.53.148 - service@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.230.166.24
description:
[2025-01-31 04:26:19 +0100] info [webmaild] 45.230.166.24 - service@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.185.41.31
description:
[2025-01-31 04:26:22 +0100] info [webmaild] 177.185.41.31 - service@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.202.24.117
description:
Jan 31 04:26:38 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.202.24.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 31 04:26:45 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.207.177.75
description:
Jan 31 04:26:48 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.207.177.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 31 04:26:49 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.128.22.214
description:
47.128.22.214 - - [31/Jan/2025:04:27:06 +0100] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13284683 HTTP/1.1" 302 0 aitedu.us "http://aitedu.us/main/index.php?Itemid=331&id=272&option=com_content&view=article" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.128.22.214


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.250.148.26
description:
[2025-01-31 04:27:06 +0100] info [webmaild] 38.250.148.26 - service@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 88.218.45.17
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:ads32b11283y@ait.edu.gh||WPU:ads32b11283y@ait.edu.gh||RSV:6.65||T:APACHE||MV:04-27.88.218.45.17


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.106.74.120
description:
2025-01-31 04:27:13 dovecot_login authenticator failed for (ADMIN) [86.106.74.120]:35394: 535 Incorrect authentication data (set_id=bscs18bit0012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.24.117
description:
2025-01-31 04:26:40 dovecot_plain authenticator failed for ([120.202.24.117]) [120.202.24.117]:46961: 535 Incorrect authentication data (set_id=ads21b00180y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.177.75
description:
2025-01-31 04:26:50 dovecot_plain authenticator failed for (49.207.177.75.actcorp.in) [49.207.177.75]:52032: 535 Incorrect authentication data (set_id=ads21b00180y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
description:
Jan 31 04:27:25 ait auth[1209597]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


