# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
description:
2025-01-27 01:29:29 dovecot_plain authenticator failed for ([117.176.204.214]) [117.176.204.214]:47601: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.155.186.7
description:
[2025-01-27 01:28:49 +0100] info [webmaild] 177.155.186.7 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-27 01:28:55 dovecot_plain authenticator failed for ([58.69.17.18]) [58.69.17.18]:38088: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Jan 27 01:29:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
description:
Jan 27 01:29:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.61.76.253
description:
Jan 27 01:28:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.61.76.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 27 01:28:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.206.105.126
description:
Jan 27 01:29:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.206.105.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.206.105.126
description:
2025-01-27 01:29:24 dovecot_login authenticator failed for ([175.206.105.126]) [175.206.105.126]:41160: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-01-27 01:29:30 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:40642: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.194.9.65
description:
Jan 27 01:29:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.194.9.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.194.9.65
description:
2025-01-27 01:29:10 dovecot_plain authenticator failed for syn-024-194-009-065.res.spectrum.com [24.194.9.65]:56252: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.56
description:
Jan 27 01:29:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.56 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 191.232.191.147
description:
Jan 27 01:29:23 ait sshd[2571932]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=191.232.191.147


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 01:30:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.118.135.187
description:
Jan 27 01:29:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.118.135.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.116.95.48
description:
2025-01-27 01:29:50 dovecot_login authenticator failed for ([203.116.95.48]) [203.116.95.48]:60318: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.4
description:
2025-01-27 01:29:51 dovecot_plain authenticator failed for ([2.55.85.4]) [2.55.85.4]:38008: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.88.97.102
description:
2025-01-27 01:29:57 dovecot_plain authenticator failed for ([201.88.97.102]) [201.88.97.102]:46503: 535 Incorrect authentication data (set_id=ads20b00370y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.116.95.48
description:
Jan 27 01:29:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.116.95.48 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-01-27 01:29:49 dovecot_plain authenticator failed for (78-134-19-99.static.eolo.it) [78.134.19.99]:47619: 535 Incorrect authentication data (set_id=masomani)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.118.135.187
description:
2025-01-27 01:29:40 dovecot_plain authenticator failed for ([183.56.179.201]) [113.118.135.187]:8338: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.85.4
description:
Jan 27 01:29:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.85.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.88.97.102
description:
Jan 27 01:29:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.88.97.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Jan 27 01:30:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-01-27 01:30:02 dovecot_plain authenticator failed for ([38.49.182.103]) [38.49.182.103]:48688: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 01:30:15 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:53837: 535 Incorrect authentication data (set_id=eng16b00239y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.11.160.60
description:
Jan 27 01:29:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.11.160.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.11.160.60
description:
2025-01-27 01:29:35 dovecot_plain authenticator failed for ([121.11.160.60]) [121.11.160.60]:39695: 535 Incorrect authentication data (set_id=masomani@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Jan 27 01:29:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.67.133.193
description:
Jan 27 01:30:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.67.133.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.227.87.29
description:
2025-01-27 01:30:52 dovecot_plain authenticator failed for ([106.227.87.29]) [106.227.87.29]:52500: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 27 01:31:19 ait sshd[2572745]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.72.4.98
description:
2025-01-27 01:31:21 dovecot_plain authenticator failed for ([112.72.4.98]) [112.72.4.98]:62342: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.78
description:
Jan 27 01:30:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.114.80.158
description:
2025-01-27 01:30:58 dovecot_plain authenticator failed for ([222.114.80.158]) [222.114.80.158]:33054: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.160.166.237
description:
2025-01-27 01:31:20 dovecot_plain authenticator failed for (237-166.adsl.static.espeed.com.bn) [119.160.166.237]:59314: 535 Incorrect authentication data (set_id=ads32b11317y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.92.208.12
description:
2025-01-27 01:31:22 dovecot_plain authenticator failed for ([116.92.208.12]) [116.92.208.12]:59656: 535 Incorrect authentication data (set_id=abs4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.101.236
description:
2025-01-27 01:30:40 dovecot_plain authenticator failed for 110-25-101-236.adsl.fetnet.net [110.25.101.236]:44165: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.114.80.158
description:
Jan 27 01:30:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.114.80.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.237.47.214
description:
2025-01-27 01:31:14 dovecot_login authenticator failed for (customer-187-237-47-214.uninet-ide.com.mx) [187.237.47.214]:58080: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.92.208.12
description:
Jan 27 01:31:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.92.208.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 27 01:30:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.237.47.214
description:
Jan 27 01:31:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.237.47.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.101.236
description:
Jan 27 01:30:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.101.236 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-27 01:30:58 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:51430: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.72.4.98
description:
Jan 27 01:31:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.72.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 27 01:31:19 ait sshd[2572745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.90.97.209
description:
2025-01-27 01:31:30 dovecot_plain authenticator failed for ([116.90.97.209]) [116.90.97.209]:41666: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.78
description:
2025-01-27 01:30:34 dovecot_plain authenticator failed for ([122.187.246.78]) [122.187.246.78]:37857: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-27 01:30:45 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:34898: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 27 01:30:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.160.166.237
description:
Jan 27 01:31:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.160.166.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.90.97.209
description:
Jan 27 01:31:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.90.97.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.227.87.29
description:
Jan 27 01:30:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.227.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.59.125
description:
Jan 27 01:31:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.59.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.67.133.193
description:
2025-01-27 01:30:44 dovecot_plain authenticator failed for ([222.67.133.193]) [222.67.133.193]:50217: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.59.125
description:
2025-01-27 01:31:08 dovecot_plain authenticator failed for ([103.171.59.125]) [103.171.59.125]:50992: 535 Incorrect authentication data (set_id=ads32b11317y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.218
description:
Jan 27 01:31:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.71.214.155
description:
Jan 27 01:31:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.71.214.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-27 01:31:53 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (orres) [83.233.242.245]:43668: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.229.232
description:
2025-01-27 01:32:16 dovecot_plain authenticator failed for ([106.107.229.232]) [106.107.229.232]:40673: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
description:
2025-01-27 01:31:37 dovecot_plain authenticator failed for ([121.22.99.2]) [121.22.99.2]:45459: 535 Incorrect authentication data (set_id=odom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
description:
Jan 27 01:31:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.218
description:
2025-01-27 01:31:46 dovecot_login authenticator failed for ([195.178.110.218]) [195.178.110.218]:54272: 535 Incorrect authentication data (set_id=user)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.206.193.131
description:
Jan 27 01:31:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.206.193.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.206.193.131
description:
2025-01-27 01:31:51 dovecot_plain authenticator failed for host-37-206-193-131.business.telecomitalia.it [37.206.193.131]:59936: 535 Incorrect authentication data (set_id=odom-oduro)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Jan 27 01:32:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-01-27 01:32:07 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:58176: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.92.230.86
description:
Jan 27 01:31:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.92.230.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.240
description:
Jan 27 01:31:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 01:32:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.107.229.232
description:
Jan 27 01:32:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.107.229.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.213.27.250
description:
Jan 27 01:32:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.213.27.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.213.27.250
description:
2025-01-27 01:32:27 dovecot_login authenticator failed for ([60.213.27.250]) [60.213.27.250]:58084: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.92.230.86
description:
2025-01-27 01:31:34 dovecot_plain authenticator failed for ([218.92.230.86]) [218.92.230.86]:59425: 535 Incorrect authentication data (set_id=abs4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 01:31:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
description:
2025-01-27 01:31:53 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:58621: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 185.23.113.65
domain: ait.edu.gh
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:01-32.185.23.113.65


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.240
description:
2025-01-27 01:31:39 dovecot_login authenticator failed for (m121-202-155-240.smartone.com) [121.202.155.240]:6905: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.255.135.74
description:
2025-01-27 01:32:42 dovecot_login authenticator failed for (131-255-135-74.otinternet.com.br) [131.255.135.74]:35488: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.189.226.81
description:
Jan 27 01:33:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.189.226.81 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.226.81
description:
2025-01-27 01:33:19 dovecot_login authenticator failed for ([121.189.226.81]) [121.189.226.81]:52738: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 01:32:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.88.91.22
description:
2025-01-27 01:33:16 dovecot_plain authenticator failed for syn-097-088-091-022.res.spectrum.com [97.88.91.22]:44878: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.76
description:
Jan 27 01:33:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.166.162.78
description:
2025-01-27 01:33:27 dovecot_plain authenticator failed for ([180.166.162.78]) [180.166.162.78]:9542: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
description:
Jan 27 01:33:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.135.74
description:
Jan 27 01:32:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.135.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.84.17.16
description:
Jan 27 01:32:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.84.17.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 01:33:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.171.64.170
description:
2025-01-27 01:33:07 dovecot_plain authenticator failed for ([50.171.64.170]) [50.171.64.170]:45462: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.88.91.22
description:
Jan 27 01:33:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.88.91.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.158.107.243
description:
[2025-01-27 01:33:18 +0100] info [webmaild] 105.158.107.243 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.166.162.78
description:
Jan 27 01:33:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.166.162.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.76
description:
2025-01-27 01:33:30 dovecot_plain authenticator failed for (95.0.252.76.static.ttnet.com.tr) [95.0.252.76]:45490: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-27 01:34:00 dovecot_plain authenticator failed for ([2.57.219.14]) [2.57.219.2]:43552: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.96.62.29
description:
Jan 27 01:33:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.96.62.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.211
description:
2025-01-27 01:33:37 dovecot_login authenticator failed for ([195.178.110.211]) [195.178.110.211]:65429: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-27 01:33:48 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:37279: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 27 01:34:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.205.235.94
description:
Jan 27 01:34:24 ait sshd[2573865]: pam_imunify(sshd:auth): [IM360_RBL] The IP 119.205.235.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.21.118
description:
2025-01-27 01:33:35 dovecot_plain authenticator failed for (5x16x21x118.static-business.spb.ertelecom.ru) [5.16.21.118]:55540: 535 Incorrect authentication data (set_id=eng20a00098y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Jan 27 01:33:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-01-27 01:33:43 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:10976: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.165
description:
Jan 27 01:34:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
description:
2025-01-27 01:33:32 dovecot_plain authenticator failed for ([59.96.62.29]) [59.96.62.29]:42438: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.49.177.201
description:
Jan 27 01:33:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.49.177.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.89.234.208
description:
2025-01-27 01:34:18 dovecot_plain authenticator failed for (deenetservices.net) [103.89.234.208]:46338: 535 Incorrect authentication data (set_id=ads18b00173y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.46
description:
Jan 27 01:34:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.29.53
description:
2025-01-27 01:33:33 dovecot_login authenticator failed for (broadband.actcorp.in) [106.51.29.53]:44574: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.162
description:
2025-01-27 01:34:14 dovecot_login authenticator failed for p7001163-ipoefx.ipoe.ocn.ne.jp [118.3.227.162]:35510: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.208.76.154
description:
2025-01-27 01:33:36 dovecot_plain authenticator failed for (186-208-76-154.veloo.com.br) [186.208.76.154]:43408: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-27 01:34:13 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:45544: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 119.205.235.94
description:
Jan 27 01:34:24 ait sshd[2573865]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.205.235.94  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.46
description:
2025-01-27 01:34:25 dovecot_login authenticator failed for ([91.73.195.46]) [91.73.195.46]:40169: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.165
description:
2025-01-27 01:34:28 dovecot_login authenticator failed for (m121-202-152-165.smartone.com) [121.202.152.165]:49283: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.29.53
description:
Jan 27 01:33:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.29.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
description:
2025-01-27 01:33:31 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:48486: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.177.201
description:
2025-01-27 01:33:46 dovecot_plain authenticator failed for ([14.49.177.201]) [14.49.177.201]:42124: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.111.22
description:
2025-01-27 01:33:47 dovecot_plain authenticator failed for ([110.34.111.22]) [110.34.111.22]:34113: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.162
description:
Jan 27 01:34:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 91.187.125.227
description:
[2025-01-27 01:34:23 +0100] info [webmaild] 91.187.125.227 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.208.76.154
description:
Jan 27 01:33:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.208.76.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.211
description:
Jan 27 01:33:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 27 01:33:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.89.234.208
description:
Jan 27 01:34:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.89.234.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.16.21.118
description:
Jan 27 01:33:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.16.21.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.111.22
description:
Jan 27 01:33:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.111.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 27 01:33:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
description:
Jan 27 01:34:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
description:
2025-01-27 01:34:56 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:38983: 535 Incorrect authentication data (set_id=ads18b00173y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 27 01:34:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-27 01:35:00 dovecot_login authenticator failed for ([221.215.87.163]) [221.215.87.163]:34389: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.253
description:
Jan 27 01:34:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.253
description:
2025-01-27 01:34:39 dovecot_plain authenticator failed for (m121-202-152-253.smartone.com) [121.202.152.253]:59286: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 01:34:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 27 01:34:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-27 01:34:53 dovecot_plain authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:54607: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Jan 27 01:35:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.117.96.174
description:
Jan 27 01:35:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.117.96.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.117.96.174
description:
2025-01-27 01:35:14 dovecot_login authenticator failed for ([190.117.96.174]) [190.117.96.174]:53046: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 209.173.10.75
description:
Jan 27 01:35:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 209.173.10.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 27 01:35:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.77
description:
2025-01-27 01:35:14 dovecot_login authenticator failed for ([111.61.176.77]) [111.61.176.77]:14234: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.77
description:
Jan 27 01:35:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.184.192.14
description:
[2025-01-27 01:35:19 +0100] info [webmaild] 45.184.192.14 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.173.10.75
description:
2025-01-27 01:35:21 dovecot_plain authenticator failed for ([209.173.10.75]) [209.173.10.75]:56420: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
description:
2025-01-27 01:35:30 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:58744: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-01-27 01:35:05 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:45630: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.30.57.201
description:
2025-01-27 01:36:06 dovecot_login authenticator failed for dynamic-186-30-57-201.dynamic.etb.net.co [186.30.57.201]:64032: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Jan 27 01:36:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.182.234.110
description:
Jan 27 01:35:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.182.234.110 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.182.234.110
description:
2025-01-27 01:35:41 dovecot_login authenticator failed for (todohogar.sati.com.py-test3) [147.182.234.110]:57240: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 01:35:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 27 01:35:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-27 01:35:53 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:34149: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.30.57.201
description:
Jan 27 01:36:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.30.57.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-01-27 01:36:15 dovecot_plain authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:54724: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.223.135.61
description:
Jan 27 01:36:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.223.135.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.223.135.61
description:
2025-01-27 01:36:29 dovecot_login authenticator failed for ([58.223.135.61]) [58.223.135.61]:49963: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.254.253.77
description:
2025-01-27 01:37:23 dovecot_plain authenticator failed for (fasestes) [185.254.253.77]:41252: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.50.164.146
description:
Jan 27 01:36:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.50.164.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 167.86.103.100
domain: iric.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/2014/07/olx.php||SC:/home/titlemas/public_html/iric.us/wp-content/uploads/2014


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 167.86.103.100
domain: iric.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:01-36.167.86.103.100||RSV:6.65||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.176.125.34
description:
2025-01-27 01:36:49 dovecot_plain authenticator failed for ([182.176.125.34]) [182.176.125.34]:32912: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.20.111.164
description:
2025-01-27 01:37:11 dovecot_plain authenticator failed for ([38.20.111.164]) [38.20.111.164]:55480: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 01:37:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 27 01:37:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.50.164.146
description:
2025-01-27 01:36:35 dovecot_plain authenticator failed for static-173-50-164-146.pghkny.fios.verizon.net [173.50.164.146]:52155: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.213.84
description:
2025-01-27 01:36:39 dovecot_plain authenticator failed for ([125.143.213.84]) [125.143.213.84]:59828: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-27 01:37:04 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:53003: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.254.253.77
description:
Jan 27 01:37:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.254.253.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.223
description:
Jan 27 01:37:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.29.76.99
description:
Jan 27 01:37:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.29.76.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.143.213.84
description:
Jan 27 01:36:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.143.213.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.176.125.34
description:
Jan 27 01:36:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.176.125.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 27 01:37:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.20.111.164
description:
Jan 27 01:37:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.20.111.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-27 01:37:22 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:36242: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.223
description:
2025-01-27 01:37:23 dovecot_plain authenticator failed for ([93.182.160.223]) [93.182.160.223]:47350: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.100.90
description:
2025-01-27 01:38:13 dovecot_login authenticator failed for ([223.241.100.90]) [223.241.100.90]:46225: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.31.73
description:
2025-01-27 01:37:53 dovecot_plain authenticator failed for ([65.76.31.73]) [65.76.31.73]:45062: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.124.94
description:
2025-01-27 01:38:04 dovecot_plain authenticator failed for (94.124.156.175.unknown.m1.com.sg) [175.156.124.94]:40163: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 01:38:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.100.90
description:
Jan 27 01:38:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.100.90 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 46.161.196.184
description:
[2025-01-27 01:37:54 +0100] info [webmaild] 46.161.196.184 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.156.124.94
description:
Jan 27 01:38:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.156.124.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.29.76.99
description:
2025-01-27 01:37:31 dovecot_login authenticator failed for ([14.29.76.100]) [14.29.76.99]:59348: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.130
description:
Jan 27 01:37:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.130
description:
2025-01-27 01:37:47 dovecot_login authenticator failed for (130.20.167.124.adsl-pool.sx.cn) [124.167.20.130]:56391: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.31.73
description:
Jan 27 01:37:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.31.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 27 01:39:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.28.77.206
description:
Jan 27 01:38:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.28.77.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-01-27 01:38:43 dovecot_login authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:34191: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.251.197.46
description:
2025-01-27 01:39:27 dovecot_login authenticator failed for ([101.251.197.46]) [101.251.197.46]:60160: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.117
description:
Jan 27 01:38:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.28.226.123
description:
Jan 27 01:39:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.28.226.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.185.255.227
description:
2025-01-27 01:38:59 dovecot_login authenticator failed for ([222.185.255.229]) [222.185.255.227]:43896: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.123
description:
2025-01-27 01:39:11 dovecot_login authenticator failed for ([196.28.226.123]) [196.28.226.123]:37430: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 27 01:38:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-27 01:38:41 dovecot_login authenticator failed for ([200.106.49.149]) [200.106.49.149]:60954: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.185.255.227
description:
Jan 27 01:38:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.185.255.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.189.151
description:
2025-01-27 01:38:50 dovecot_login authenticator failed for 5.185.189.151.ipv4.public.orange.pl [5.185.189.151]:36280: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.238.74
description:
Jan 27 01:39:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.238.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.28.77.206
description:
2025-01-27 01:38:37 dovecot_plain authenticator failed for (pc0.zz.ha.cn) [218.28.77.206]:34189: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.175.117
description:
2025-01-27 01:38:39 dovecot_login authenticator failed for ([111.61.175.117]) [111.61.175.117]:13796: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.20.6.2
description:
2025-01-27 01:38:42 dovecot_plain authenticator failed for (187-8-73-30.customer.tdatabrasil.net.br) [189.20.6.2]:53183: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
description:
2025-01-27 01:38:59 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:50086: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.113.9.34
description:
2025-01-27 01:38:59 dovecot_plain authenticator failed for ([111.113.9.34]) [111.113.9.34]:34428: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
description:
Jan 27 01:38:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.251.197.46
description:
Jan 27 01:39:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.251.197.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.189.151
description:
Jan 27 01:38:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.189.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.113.9.34
description:
Jan 27 01:38:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.113.9.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 27 01:38:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.92.244.134
description:
[2025-01-27 01:39:15 +0100] info [webmaild] 177.92.244.134 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.20.6.2
description:
Jan 27 01:38:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.20.6.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.238.74
description:
2025-01-27 01:39:13 dovecot_login authenticator failed for ([104.241.238.74]) [104.241.238.74]:38182: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
description:
2025-01-27 01:39:46 dovecot_login authenticator failed for ([111.61.177.2]) [111.61.177.2]:20542: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 169.211.232.182
description:
Jan 27 01:40:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 169.211.232.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
description:
2025-01-27 01:40:07 dovecot_plain authenticator failed for ([169.211.232.182]) [169.211.232.182]:44044: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 27 01:40:17 ait sshd[2576375]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.253.37
description:
2025-01-27 01:40:21 dovecot_login authenticator failed for ([218.22.253.37]) [218.22.253.37]:45790: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-27 01:39:32 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:64203: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.232.247.77
description:
Jan 27 01:39:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.232.247.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.182.160.222
description:
Jan 27 01:40:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.182.160.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.182.160.222
description:
2025-01-27 01:40:24 dovecot_login authenticator failed for ([93.182.160.222]) [93.182.160.222]:59678: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-27 01:40:26 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:36534: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.253.37
description:
Jan 27 01:40:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.253.37 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 27 01:40:17 ait sshd[2576375]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 27 01:40:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
description:
Jan 27 01:39:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.232.247.77
description:
2025-01-27 01:39:48 dovecot_plain authenticator failed for ([103.232.247.77]) [103.232.247.77]:57062: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 01:40:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.252.204.203
description:
2025-01-27 01:40:42 dovecot_plain authenticator failed for ([1.252.204.203]) [1.252.204.203]:62584: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.140.237.178
description:
[2025-01-27 01:41:02 +0100] info [webmaild] 201.140.237.178 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.203.21.15
domain: worldwide-university.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/images/about.php||SC:/home/wwuni002/public_html/wp-includes/images/about.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.206.117.105
description:
2025-01-27 01:40:35 dovecot_login authenticator failed for ([119.206.117.105]) [119.206.117.105]:46798: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
description:
Jan 27 01:40:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.252.204.203
description:
Jan 27 01:40:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.252.204.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.24
description:
Jan 27 01:41:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.203.21.12
domain: worldwide-university.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/wwuni002/public_html/wp-content/uploads/index.php


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.142.41.167
description:
Jan 27 01:41:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.142.41.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.142.41.167
description:
2025-01-27 01:41:21 dovecot_plain authenticator failed for ([78.142.41.167]) [78.142.41.167]:58848: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.24
description:
2025-01-27 01:41:29 dovecot_plain authenticator failed for ([185.167.56.24]) [185.167.56.24]:46274: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.249
description:
Jan 27 01:40:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.249
description:
2025-01-27 01:40:37 dovecot_login authenticator failed for ([104.241.231.249]) [104.241.231.249]:44515: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
description:
2025-01-27 01:40:39 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:27884: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.179.241.253
description:
Jan 27 01:40:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.179.241.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.179.241.253
description:
2025-01-27 01:40:32 dovecot_plain authenticator failed for 89-179-241-253.static.corbina.ru [89.179.241.253]:56412: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.206.117.105
description:
Jan 27 01:40:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.206.117.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Jan 27 01:42:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.51.122.230
description:
2025-01-27 01:41:46 dovecot_plain authenticator failed for ([58.51.122.230]) [58.51.122.230]:57732: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
description:
2025-01-27 01:41:51 dovecot_login authenticator failed for 69-172-79-198.static.imsbiz.com (173-248-234-145.static.imsbiz.com) [69.172.79.198]:58727: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.172.79.198
description:
Jan 27 01:41:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.172.79.198 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 178.63.225.184
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:Administrarot||WPU:Administrarot||RSV:6.65||T:APACHE||MV:01-41.178.63.225.184


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.164.235.208
description:
2025-01-27 01:41:32 dovecot_plain authenticator failed for (208.235.164.124.adsl-pool.sx.cn) [124.164.235.208]:57503: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-27 01:41:38 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:43701: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.158.141
description:
2025-01-27 01:42:08 dovecot_login authenticator failed for p87142-obmd01.osaka.ocn.ne.jp [180.7.158.141]:48761: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.226.173.151
description:
2025-01-27 01:42:22 dovecot_plain authenticator failed for (pool-176-226-173-151.is74.ru) [176.226.173.151]:51218: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.164.235.208
description:
Jan 27 01:41:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.164.235.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 27 01:41:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.86.200.16
description:
Jan 27 01:42:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.86.200.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.51.122.230
description:
Jan 27 01:41:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.51.122.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.226.173.151
description:
Jan 27 01:42:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.226.173.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 01:41:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-01-27 01:42:13 dovecot_plain authenticator failed for (carlempter) [102.53.15.180]:46671: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 85.203.21.36
domain: worldwide-university.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/wwuni002/public_html/wp-admin/images/admin.php


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.86.200.16
description:
2025-01-27 01:42:21 dovecot_login authenticator failed for (16.200.86.116.starhub.net.sg) [116.86.200.16]:41344: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.158.141
description:
Jan 27 01:42:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.158.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.3.16.128
description:
Jan 27 01:43:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.3.16.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.249.230.27
description:
Jan 27 01:42:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.249.230.27 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 27 01:42:36 ait sshd[2577488]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.62.243.174
description:
Jan 27 01:42:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.62.243.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.226.132.113
description:
2025-01-27 01:43:13 dovecot_plain authenticator failed for ([188.226.132.113]) [188.226.132.113]:46962: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.246.45.57
description:
Jan 27 01:43:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.246.45.57 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.3.16.128
description:
2025-01-27 01:43:23 dovecot_plain authenticator failed for 128.16.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.16.128]:37111: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 27 01:42:36 ait sshd[2577488]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.231.225
description:
Jan 27 01:42:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.231.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.231.225
description:
2025-01-27 01:43:00 dovecot_login authenticator failed for ([104.241.231.225]) [104.241.231.225]:51672: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.249.230.27
description:
2025-01-27 01:42:39 dovecot_plain authenticator failed for ([183.249.230.27]) [183.249.230.27]:58022: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.226.132.113
description:
Jan 27 01:43:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.226.132.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 85.203.21.67
domain: worldwide-university.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:6.65||T:APACHE||SC:/home/wwuni002/public_html/wp-content/plugins/ubh||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.246.45.57
description:
2025-01-27 01:43:23 dovecot_plain authenticator failed for 57-45-246-103.southernonline.net [103.246.45.57]:39026: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/engine1/js/engine1/css/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.243.174
description:
2025-01-27 01:42:49 dovecot_login authenticator failed for (92.62.243.174.fibermax.bg) [92.62.243.174]:51917: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.168.58.143
description:
2025-01-27 01:44:01 dovecot_plain authenticator failed for ([45.168.58.143]) [45.168.58.143]:36505: 535 Incorrect authentication data (set_id=ads20b00297y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.169.52
description:
Jan 27 01:44:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.169.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.191.94
description:
2025-01-27 01:43:35 dovecot_plain authenticator failed for ([68.183.191.94]) [68.183.191.94]:55854: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.168.58.143
description:
Jan 27 01:43:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.168.58.143 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.69.178.104
description:
2025-01-27 01:44:01 dovecot_plain authenticator failed for 104.178.69.85.rev.sfr.net (goded) [85.69.178.104]:42648: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.169.52
description:
2025-01-27 01:44:13 dovecot_plain authenticator failed for ([124.239.169.52]) [124.239.169.52]:38854: 535 Incorrect authentication data (set_id=ads20b00297y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.69.178.104
description:
Jan 27 01:43:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.69.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.214.201.195
description:
Jan 27 01:44:23 ait sshd[2578069]: pam_imunify(sshd:auth): [IM360_RBL] The IP 162.214.201.195 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 162.214.201.195
description:
Jan 27 01:44:23 ait sshd[2578069]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=162.214.201.195  user=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/engine1/engine1/js/css/css/why_ait.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.183.191.94
description:
Jan 27 01:43:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.183.191.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-01-27 01:44:59 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:41935: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.187.50.49
description:
Jan 27 01:45:17 ait sshd[2578576]: pam_imunify(sshd:auth): [IM360_RBL] The IP 185.187.50.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
description:
Jan 27 01:45:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.219.125.158
description:
2025-01-27 01:45:28 dovecot_login authenticator failed for (host-178.219.125.158-c3.net.pl) [178.219.125.158]:48819: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.193
description:
Jan 27 01:45:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 27 01:45:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.178.176.85
description:
Jan 27 01:45:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.178.176.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.127.40.19
description:
Jan 27 01:44:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.127.40.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/engine1/engine1/css/js/css/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.127.40.19
description:
2025-01-27 01:44:39 dovecot_login authenticator failed for (115.127.40.33.bracnet.net) [115.127.40.19]:41965: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.125.158
description:
Jan 27 01:45:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.125.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Jan 27 01:44:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.193
description:
2025-01-27 01:45:15 dovecot_login authenticator failed for ([104.241.230.193]) [104.241.230.193]:57887: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 185.187.50.49
description:
Jan 27 01:45:17 ait sshd[2578576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.187.50.49  user=gvu


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.74.136.134
description:
Jan 27 01:45:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.74.136.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.45.50.125
description:
Jan 27 01:45:58 ait sshd[2578901]: pam_imunify(sshd:auth): [IM360_RBL] The IP 31.45.50.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-27 01:45:30 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:40744: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.237.66
description:
2025-01-27 01:45:40 dovecot_login authenticator failed for ([104.241.237.66]) [104.241.237.66]:40059: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.74.136.134
description:
2025-01-27 01:45:59 dovecot_login authenticator failed for syn-050-074-136-134.biz.spectrum.com [50.74.136.134]:42856: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.58
description:
2025-01-27 01:46:19 dovecot_login authenticator failed for ([104.241.229.58]) [104.241.229.58]:46803: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 01:46:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/engine1/css/engine1/css/js/index.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.58
description:
Jan 27 01:46:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.58 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 105.245.122.213
description:
[2025-01-27 01:46:27 +0100] info [webmaild] 105.245.122.213 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.115.254.158
description:
Jan 27 01:45:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.115.254.158 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 31.45.50.125
description:
Jan 27 01:45:58 ait sshd[2578901]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=31.45.50.125  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.237.66
description:
Jan 27 01:45:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.237.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.115.254.158
description:
2025-01-27 01:45:47 dovecot_plain authenticator failed for ([103.115.254.158]) [103.115.254.158]:51836: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 27 01:46:15 ait sshd[2578995]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 27 01:46:15 ait sshd[2578995]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
description:
2025-01-27 01:45:31 dovecot_login authenticator failed for ([211.93.6.230]) [211.93.6.230]:35860: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.178.176.85
description:
2025-01-27 01:45:31 dovecot_plain authenticator failed for ([221.178.176.85]) [221.178.176.85]:47305: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.8.12
description:
2025-01-27 01:46:43 dovecot_plain authenticator failed for ([194.31.8.12]) [194.31.8.12]:65107: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.118.144.44
description:
[2025-01-27 01:47:09 +0100] info [webmaild] 181.118.144.44 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.255.221
description:
Jan 27 01:47:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.255.221 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/js/engine1/css/css/engine1/academic.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.88.91.22
description:
2025-01-27 01:46:51 dovecot_plain authenticator failed for syn-097-088-091-022.res.spectrum.com [97.88.91.22]:43121: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.224.129.102
description:
Jan 27 01:47:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.224.129.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.255.221
description:
2025-01-27 01:47:24 dovecot_plain authenticator failed for ([218.146.255.221]) [218.146.255.221]:60476: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.165.83
description:
Jan 27 01:47:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.31.8.12
description:
Jan 27 01:46:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.31.8.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 97.88.91.22
description:
Jan 27 01:46:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 97.88.91.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.227.36.27
domain: ait-edu.us
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/engine1/css/images/js/js/data1/images/data1/images/data1/css/engine1/engine1/js/css/admissionlist.php||SC:/home/titlemas/public_html/AIT-EDU.US/engine1/css


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.255.231.10
description:
Jan 27 01:47:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.255.231.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-27 01:48:12 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:48979: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.224.129.102
description:
Jan 27 01:47:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.224.129.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 27 01:48:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.206.93.90
description:
2025-01-27 01:48:16 dovecot_login authenticator failed for ([94.206.93.90]) [94.206.93.90]:48700: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 27 01:48:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.51.226.207
description:
Jan 27 01:48:02 ait sshd[2579820]: pam_imunify(sshd:auth): [IM360_RBL] The IP 20.51.226.207 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.75.104.218
description:
2025-01-27 01:48:14 dovecot_login authenticator failed for ([91.75.104.218]) [91.75.104.218]:43298: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.236.155.146
description:
Jan 27 01:47:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.236.155.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-27 01:48:04 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:59954: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.75.104.218
description:
Jan 27 01:48:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.75.104.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.255.231.10
description:
2025-01-27 01:47:58 dovecot_plain authenticator failed for ([106.255.231.10]) [106.255.231.10]:33863: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 27 01:48:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.165.83
description:
2025-01-27 01:47:31 dovecot_plain authenticator failed for ([65.20.165.83]) [65.20.165.83]:55901: 535 Incorrect authentication data (set_id=klah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.236.155.146
description:
2025-01-27 01:47:40 dovecot_plain authenticator failed for ([222.236.155.146]) [222.236.155.146]:53478: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.112.80.222
description:
Jan 27 01:47:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.112.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.70.95
description:
2025-01-27 01:47:45 dovecot_plain authenticator failed for ([121.170.70.95]) [121.170.70.95]:42203: 535 Incorrect authentication data (set_id=klah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.170.70.95
description:
Jan 27 01:47:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.170.70.95 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-27 01:48:10 dovecot_plain authenticator failed for (psipten) [81.211.77.58]:21194: 535 Incorrect authentication data (set_id=edonkor@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.148.199.165
description:
Jan 27 01:47:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.148.199.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.148.199.165
description:
2025-01-27 01:47:34 dovecot_login authenticator failed for 165.199.148.122.sta.wbroadband.net.au [122.148.199.165]:38153: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.112.80.222
description:
2025-01-27 01:47:46 dovecot_login authenticator failed for ([36.112.80.222]) [36.112.80.222]:39589: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 20.51.226.207
description:
Jan 27 01:48:02 ait sshd[2579820]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=20.51.226.207  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.206.93.90
description:
Jan 27 01:48:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.206.93.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.128.209.48
description:
Jan 27 01:48:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.128.209.48 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.126.195.176
description:
Jan 27 01:48:50 ait sshd[2580121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.126.195.176


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
description:
2025-01-27 01:48:50 dovecot_plain authenticator failed for (138.219.244.10.static.softdados.net) [177.128.209.48]:42654: 535 Incorrect authentication data (set_id=eng20a00047y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.84.11.180
description:
Jan 27 01:48:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.84.11.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.34.111.22
description:
2025-01-27 01:49:01 dovecot_plain authenticator failed for ([110.34.111.22]) [110.34.111.22]:53948: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.7.159.114
description:
2025-01-27 01:49:24 dovecot_plain authenticator failed for p88115-obmd01.osaka.ocn.ne.jp [180.7.159.114]:45448: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 27 01:49:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-27 01:49:10 dovecot_plain authenticator failed for ([121.202.155.182]) [121.202.155.182]:63917: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.78.92.131
description:
2025-01-27 01:48:38 dovecot_plain authenticator failed for ([101.91.236.162]) [218.78.92.131]:39768: 535 Incorrect authentication data (set_id=eng20a00047y@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.195.176
description:
Jan 27 01:48:50 ait sshd[2580121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.126.195.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.34.111.22
description:
Jan 27 01:48:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.34.111.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.84.11.180
description:
2025-01-27 01:49:00 dovecot_plain authenticator failed for ([59.84.11.180]) [59.84.11.180]:5468: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.209.48.203
description:
2025-01-27 01:49:05 dovecot_login authenticator failed for ([221.209.48.204]) [221.209.48.203]:52094: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.195.103
description:
Jan 27 01:49:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.195.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.57.106
description:
2025-01-27 01:49:16 dovecot_login authenticator failed for ([65.76.57.106]) [65.76.57.106]:58646: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.7.159.114
description:
Jan 27 01:49:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.7.159.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.57.106
description:
Jan 27 01:49:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.57.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.78.92.131
description:
Jan 27 01:48:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.78.92.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.97.253.246
description:
Jan 27 01:48:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.97.253.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.97.253.246
description:
2025-01-27 01:48:39 dovecot_login authenticator failed for syn-024-097-253-246.biz.spectrum.com [24.97.253.246]:40110: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.94.242
description:
Jan 27 01:48:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.94.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.94.242
description:
2025-01-27 01:48:52 dovecot_login authenticator failed for ([116.114.94.242]) [116.114.94.242]:40562: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.209.48.203
description:
Jan 27 01:49:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.209.48.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.195.103
description:
2025-01-27 01:49:15 dovecot_plain authenticator failed for (m121-202-195-103.smartone.com) [121.202.195.103]:64083: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 01:49:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.36.155.187
description:
Jan 27 01:49:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.36.155.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.36.155.187
description:
2025-01-27 01:49:34 dovecot_login authenticator failed for (136-36-155-187.googlefiber.net) [136.36.155.187]:52180: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.250.241
description:
2025-01-27 01:49:46 dovecot_login authenticator failed for ([31.141.250.241]) [31.141.250.241]:54974: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.229.86
description:
Jan 27 01:49:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.229.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.229.86
description:
2025-01-27 01:49:58 dovecot_plain authenticator failed for ([31.141.229.86]) [31.141.229.86]:40489: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.216.101.162
description:
2025-01-27 01:50:03 dovecot_plain authenticator failed for ([58.216.101.166]) [58.216.101.162]:43647: 535 Incorrect authentication data (set_id=eng67b66769@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.47.149.59
description:
Jan 27 01:49:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.47.149.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.132.14.159
description:
2025-01-27 01:49:34 dovecot_login authenticator failed for ([112.123.199.111]) [112.132.14.159]:45100: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.250.241
description:
Jan 27 01:49:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.250.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.148.32.193
description:
Jan 27 01:49:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.148.32.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.216.101.162
description:
Jan 27 01:50:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.216.101.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.228.225.91
description:
2025-01-27 01:50:09 dovecot_plain authenticator failed for 125-228-225-91.hinet-ip.hinet.net [125.228.225.91]:54841: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.190.118.132
description:
Jan 27 01:49:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.190.118.132 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
description:
2025-01-27 01:49:33 dovecot_login authenticator failed for host59.sub-63-47-149.myvzw.com [63.47.149.59]:45228: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.118.132
description:
2025-01-27 01:49:34 dovecot_plain authenticator failed for ([196.190.118.132]) [196.190.118.132]:51038: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.148.32.193
description:
2025-01-27 01:49:51 dovecot_login authenticator failed for vps-97b94c77.vps.ovh.us (ALiqCI) [135.148.32.193]:41897: 535 Incorrect authentication data (set_id=tsagli@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.228.225.91
description:
Jan 27 01:50:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.228.225.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.185.1.177
description:
Jan 27 01:50:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.185.1.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.185.1.177
description:
2025-01-27 01:50:13 dovecot_plain authenticator failed for ([179.185.1.177]) [179.185.1.177]:55587: 535 Incorrect authentication data (set_id=eng67b66769)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.132.14.159
description:
Jan 27 01:49:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.132.14.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-01-27 01:51:11 dovecot_plain authenticator failed for ([121.168.210.98]) [121.168.210.98]:22345: 535 Incorrect authentication data (set_id=ujakpa@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 27 01:51:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.82.157.126
description:
2025-01-27 01:51:19 dovecot_plain authenticator failed for 140.82.157.126.360broadband.net [140.82.157.126]:54772: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-27 01:51:21 dovecot_plain authenticator failed for ([221.215.87.163]) [221.215.87.163]:54575: 535 Incorrect authentication data (set_id=abs08b99933y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Jan 27 01:51:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.32.253.235
description:
Jan 27 01:50:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.32.253.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.253.235
description:
2025-01-27 01:50:49 dovecot_plain authenticator failed for ([213.32.253.235]) [213.32.253.235]:59999: 535 Incorrect authentication data (set_id=rnunator)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.232.175.64
description:
Jan 27 01:50:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.232.175.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 27 01:51:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.12.2.110
description:
2025-01-27 01:51:23 dovecot_plain authenticator failed for ([187.12.2.110]) [187.12.2.110]:46776: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.178.198.136
description:
2025-01-27 01:50:40 dovecot_plain authenticator failed for ([117.178.198.136]) [117.178.198.136]:52126: 535 Incorrect authentication data (set_id=rnunator@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 01:50:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.223.144
description:
Jan 27 01:51:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.223.144 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.163.241.41
description:
[2025-01-27 01:51:09 +0100] info [webmaild] 45.163.241.41 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.223.144
description:
2025-01-27 01:51:09 dovecot_login authenticator failed for ([220.80.223.144]) [220.80.223.144]:52958: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 140.82.157.126
description:
Jan 27 01:51:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 140.82.157.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.12.2.110
description:
Jan 27 01:51:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.12.2.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.178.198.136
description:
Jan 27 01:50:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.178.198.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.160.227.134
description:
Jan 27 01:50:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.160.227.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-27 01:51:04 dovecot_plain authenticator failed for (hebei.8.60.in-addr.arpa) [60.8.50.150]:54144: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.232.175.64
description:
2025-01-27 01:50:53 dovecot_plain authenticator failed for ([37.232.175.64]) [37.232.175.64]:33402: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.160.227.134
description:
2025-01-27 01:50:55 dovecot_login authenticator failed for ([222.160.227.134]) [222.160.227.134]:46754: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.99.89.74
description:
Jan 27 01:52:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.99.89.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.164.211.155
description:
Jan 27 01:51:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.164.211.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Jan 27 01:51:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-01-27 01:51:39 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:65176: 535 Incorrect authentication data (set_id=ug21m1150009@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.164.211.155
description:
2025-01-27 01:51:41 dovecot_login authenticator failed for ([212.164.211.155]) [212.164.211.155]:39976: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
description:
2025-01-27 01:51:53 dovecot_plain authenticator failed for ([203.123.219.137]) [203.123.219.137]:44420: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.66
description:
2025-01-27 01:52:11 dovecot_login authenticator failed for ([92.118.39.66]) [92.118.39.66]:57582: 535 Incorrect authentication data (set_id=demo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.99.89.74
description:
2025-01-27 01:52:21 dovecot_login authenticator failed for ([183.99.89.74]) [183.99.89.74]:33472: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.7.200.152
description:
Jan 27 01:51:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.7.200.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.117.118
description:
Jan 27 01:51:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 184.71.121.54
description:
Jan 27 01:51:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 184.71.121.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.250.241
description:
Jan 27 01:51:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.250.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.250.241
description:
2025-01-27 01:51:50 dovecot_login authenticator failed for ([31.141.250.241]) [31.141.250.241]:32984: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.123.33
description:
Jan 27 01:51:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.123.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.191.170.208
description:
2025-01-27 01:51:49 dovecot_plain authenticator failed for syn-108-191-170-208.biz.spectrum.com [108.191.170.208]:51520: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.71.121.54
description:
2025-01-27 01:51:55 dovecot_login authenticator failed for ([184.71.121.54]) [184.71.121.54]:60301: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.223.177.215
description:
Jan 27 01:51:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.223.177.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.54.14
description:
Jan 27 01:51:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.54.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.117.118
description:
2025-01-27 01:51:37 dovecot_plain authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:64326: 535 Incorrect authentication data (set_id=abs08b99933y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
description:
2025-01-27 01:51:33 dovecot_plain authenticator failed for v157-7-200-152.cwit.static.cnode.io [157.7.200.152]:59300: 535 Incorrect authentication data (set_id=ujakpa)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Jan 27 01:51:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.191.170.208
description:
Jan 27 01:51:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.191.170.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.34.28
description:
Jan 27 01:52:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.34.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.34.28
description:
2025-01-27 01:52:10 dovecot_login authenticator failed for 96-1-34-28-staticipeast.wireless.telus.com [96.1.34.28]:43803: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.127.232.248
description:
Jan 27 01:51:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.127.232.248 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.121.148.141
description:
[2025-01-27 01:51:31 +0100] info [webmaild] 168.121.148.141 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.188
description:
Jan 27 01:52:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.188
description:
2025-01-27 01:52:07 dovecot_login authenticator failed for ([111.61.176.188]) [111.61.176.188]:44700: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.66
description:
Jan 27 01:52:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.223.177.215
description:
2025-01-27 01:51:59 dovecot_plain authenticator failed for ([223.223.177.220]) [223.223.177.215]:52517: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 216.10.245.107
description:
Jan 27 01:52:00 ait sshd[2581475]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=216.10.245.107  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.123.33
description:
2025-01-27 01:51:43 dovecot_plain authenticator failed for ([117.176.123.33]) [117.176.123.33]:44054: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.123.219.137
description:
Jan 27 01:51:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.123.219.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-01-27 01:51:54 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:42339: 535 Incorrect authentication data (set_id=ug21m1150009)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 216.10.245.107
description:
Jan 27 01:52:00 ait sshd[2581475]: pam_imunify(sshd:auth): [IM360_RBL] The IP 216.10.245.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.127.232.248
description:
2025-01-27 01:51:32 dovecot_plain authenticator failed for syn-070-127-232-248.res.spectrum.com [70.127.232.248]:45679: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.54.14
description:
2025-01-27 01:51:37 dovecot_plain authenticator failed for ([200.141.225.73]) [200.149.54.14]:59542: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.243.37
description:
Jan 27 01:53:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.243.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.64.108.27
description:
Jan 27 01:52:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.64.108.27 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.247.49.13
description:
[2025-01-27 01:52:34 +0100] info [webmaild] 186.247.49.13 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
description:
Jan 27 01:52:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.34.57.78
description:
Jan 27 01:53:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.34.57.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.64.108.27
description:
2025-01-27 01:52:37 dovecot_plain authenticator failed for net-93-64-108-27.cust.vodafonedsl.it [93.64.108.27]:34869: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.77.56.175
description:
Jan 27 01:52:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.77.56.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
description:
2025-01-27 01:53:00 dovecot_plain authenticator failed for 54.126.103.87.rev.vodafone.pt (scommously) [87.103.126.54]:9981: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.219.110.215
description:
Jan 27 01:53:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.219.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.34.57.78
description:
2025-01-27 01:53:15 dovecot_plain authenticator failed for ([113.125.57.231]) [203.34.57.78]:44530: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.164.185.13
description:
Jan 27 01:53:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.164.185.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.32.239.247
description:
2025-01-27 01:53:23 dovecot_plain authenticator failed for broadband-188-32-239-247.ip.moscow.rt.ru [188.32.239.247]:58330: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.164.185.13
description:
2025-01-27 01:53:25 dovecot_plain authenticator failed for (5x164x185x13.dynamic.samara.ertelecom.ru) [5.164.185.13]:32771: 535 Incorrect authentication data (set_id=laryea)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 01:52:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.77.56.175
description:
2025-01-27 01:52:46 dovecot_plain authenticator failed for ([182.77.56.175]) [182.77.56.175]:49441: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.219.110.215
description:
2025-01-27 01:53:14 dovecot_plain authenticator failed for 124-219-110-215.vdslpro.static.apol.com.tw [124.219.110.215]:43656: 535 Incorrect authentication data (set_id=laryea@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.47.229.204
description:
[2025-01-27 01:53:15 +0100] info [webmaild] 177.47.229.204 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 162.255.21.110
description:
Jan 27 01:53:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 162.255.21.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.32.239.247
description:
Jan 27 01:53:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.32.239.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.255.21.110
description:
2025-01-27 01:53:20 dovecot_login authenticator failed for (static.162.255.21.110.macminivault.com) [162.255.21.110]:57299: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.134.243.37
description:
2025-01-27 01:53:27 dovecot_login authenticator failed for ([31.134.243.37]) [31.134.243.37]:44109: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.198.73
description:
Jan 27 01:53:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.198.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 27 01:53:52 ait sshd[2582082]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.218.10.21
description:
Jan 27 01:53:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.218.10.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.89.143.234
description:
Jan 27 01:54:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.89.143.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.89.143.234
description:
2025-01-27 01:54:13 dovecot_plain authenticator failed for ([222.89.143.234]) [222.89.143.234]:46022: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.139.41.6
description:
Jan 27 01:54:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.139.41.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.139.41.6
description:
2025-01-27 01:54:25 dovecot_plain authenticator failed for ([219.139.41.6]) [219.139.41.6]:51632: 535 Incorrect authentication data (set_id=ads17b00151y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 01:54:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.148.36.64
description:
Jan 27 01:53:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.148.36.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.128.80.201
description:
Jan 27 01:54:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.128.80.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.218.10.21
description:
2025-01-27 01:54:01 dovecot_plain authenticator failed for ([118.218.10.21]) [118.218.10.21]:40919: 535 Incorrect authentication data (set_id=ads18b00116y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.155.182
description:
Jan 27 01:54:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.155.182 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 01:54:16 ait sshd[2582288]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Jan 27 01:53:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 27 01:53:52 ait sshd[2582082]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.198.73
description:
2025-01-27 01:53:31 dovecot_login authenticator failed for 5.185.198.73.ipv4.public.orange.pl [5.185.198.73]:49184: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-01-27 01:53:39 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:42422: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.148.36.64
description:
2025-01-27 01:53:51 dovecot_plain authenticator failed for 64.sub-166-148-36.myvzw.com [166.148.36.64]:55731: 535 Incorrect authentication data (set_id=ads18b00116y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.128.80.201
description:
2025-01-27 01:54:02 dovecot_login authenticator failed for ([222.128.80.201]) [222.128.80.201]:11386: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 01:54:16 ait sshd[2582288]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.155.182
description:
2025-01-27 01:54:18 dovecot_login authenticator failed for (m121-202-155-182.smartone.com) [121.202.155.182]:64222: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 182.61.10.212
description:
Jan 27 01:55:11 ait sshd[2582747]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=182.61.10.212  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.252.72
description:
Jan 27 01:55:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 27 01:54:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.191.239.186
description:
2025-01-27 01:55:05 dovecot_login authenticator failed for ([60.191.239.186]) [60.191.239.186]:41681: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.61.10.212
description:
Jan 27 01:55:11 ait sshd[2582747]: pam_imunify(sshd:auth): [IM360_RBL] The IP 182.61.10.212 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
description:
Jan 27 01:55:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.99.153.21
description:
Jan 27 01:55:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.99.153.21 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 190.97.231.231
description:
[2025-01-27 01:55:24 +0100] info [webmaild] 190.97.231.231 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.80.192.168
description:
Jan 27 01:55:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.80.192.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.130
description:
2025-01-27 01:54:46 dovecot_login authenticator failed for ([104.241.234.130]) [104.241.234.130]:55942: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 143.202.41.253
description:
[2025-01-27 01:54:48 +0100] info [webmaild] 143.202.41.253 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.113.183.73
description:
2025-01-27 01:54:53 dovecot_login authenticator failed for ([74.113.183.73]) [74.113.183.73]:56946: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.192.168
description:
2025-01-27 01:55:06 dovecot_login authenticator failed for ([220.80.192.168]) [220.80.192.168]:60684: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.85.202
description:
2025-01-27 01:55:12 dovecot_plain authenticator failed for ([196.191.212.226]) [213.55.85.202]:2357: 535 Incorrect authentication data (set_id=abs20b00128y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.99.153.21
description:
2025-01-27 01:55:21 dovecot_plain authenticator failed for ([59.99.153.21]) [59.99.153.21]:52230: 535 Incorrect authentication data (set_id=abs20b00128y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.193.242.51
description:
[2025-01-27 01:54:44 +0100] info [webmaild] 186.193.242.51 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
description:
2025-01-27 01:55:16 dovecot_plain authenticator failed for ([183.236.130.182]) [183.236.130.182]:45672: 535 Incorrect authentication data (set_id=amadam@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.207.78.191
description:
Jan 27 01:55:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.207.78.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-27 01:54:58 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:60697: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.113.183.73
description:
Jan 27 01:54:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.113.183.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.55.85.202
description:
Jan 27 01:55:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.55.85.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.0.252.72
description:
2025-01-27 01:55:26 dovecot_plain authenticator failed for ([95.0.252.72]) [95.0.252.72]:48828: 535 Incorrect authentication data (set_id=amadam)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.130
description:
Jan 27 01:54:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 01:55:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.78.191
description:
2025-01-27 01:55:19 dovecot_login authenticator failed for ([119.207.78.191]) [119.207.78.191]:38328: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-27 01:54:32 dovecot_plain authenticator failed for 83-233-242-245.cust.bredband2.com (hyphy) [83.233.242.245]:44864: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.87.248.223
description:
2025-01-27 01:56:06 dovecot_plain authenticator failed for 95-87-248-223.ip.btc-net.bg [95.87.248.223]:48816: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 27 01:56:09 ait sshd[2583195]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.126
description:
Jan 27 01:56:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
description:
2025-01-27 01:56:18 dovecot_plain authenticator failed for (165-220-169-113.cust.exede.net) [165.220.169.113]:50633: 535 Incorrect authentication data (set_id=abs21a00043y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.202.15.69
description:
2025-01-27 01:55:46 dovecot_login authenticator failed for ([12.202.15.69]) [12.202.15.69]:33950: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.94.74.150
description:
Jan 27 01:55:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.94.74.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.223.49
description:
Jan 27 01:55:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.223.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.87.248.223
description:
Jan 27 01:56:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.87.248.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.49.179.157
description:
Jan 27 01:56:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.49.179.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 27 01:56:09 ait sshd[2583195]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.126
description:
2025-01-27 01:56:15 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:43099: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 12.202.15.69
description:
Jan 27 01:55:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 12.202.15.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.74.150
description:
2025-01-27 01:55:57 dovecot_plain authenticator failed for ([180.94.74.150]) [180.94.74.150]:50750: 535 Incorrect authentication data (set_id=eng18b00217y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.49.179.157
description:
2025-01-27 01:56:12 dovecot_plain authenticator failed for syn-045-049-179-157.res.spectrum.com [45.49.179.157]:35433: 535 Incorrect authentication data (set_id=eng18b00217y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.223.49
description:
2025-01-27 01:56:00 dovecot_login authenticator failed for ([211.105.223.49]) [211.105.223.49]:38558: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.169.113
description:
Jan 27 01:56:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.169.113 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.151.97
description:
2025-01-27 01:57:26 dovecot_login authenticator failed for ([61.81.151.97]) [61.81.151.97]:45542: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.79.174.131
description:
Jan 27 01:56:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.79.174.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.152.108.61
description:
Jan 27 01:56:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.152.108.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.81.151.97
description:
Jan 27 01:57:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.81.151.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
description:
2025-01-27 01:57:00 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:37410: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.167.55.230
description:
Jan 27 01:57:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.167.55.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-01-27 01:57:25 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:40895: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.126
description:
2025-01-27 01:56:31 dovecot_plain authenticator failed for ([149.54.15.126]) [149.54.15.126]:43479: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.79.174.131
description:
2025-01-27 01:56:42 dovecot_plain authenticator failed for ([96.79.174.131]) [96.79.174.131]:33414: 535 Incorrect authentication data (set_id=abs21a00043y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.152.108.61
description:
2025-01-27 01:56:50 dovecot_plain authenticator failed for syn-098-152-108-061.biz.spectrum.com [98.152.108.61]:51818: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
description:
Jan 27 01:56:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.233.179
description:
2025-01-27 01:57:49 dovecot_login authenticator failed for ([104.241.233.179]) [104.241.233.179]:36549: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.106.37.249
description:
Jan 27 01:57:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.106.37.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.171.127.190
description:
2025-01-27 01:57:49 dovecot_login authenticator failed for ([111.171.127.190]) [111.171.127.190]:48117: 535 Incorrect authentication data


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 01:58:14 ait sshd[2584191]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.174.88.241
description:
Jan 27 01:58:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.174.88.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.106.37.249
description:
2025-01-27 01:57:36 dovecot_login authenticator failed for host-62-106-37-249.dynamic.elmonet.fi [62.106.37.249]:39572: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.233.179
description:
Jan 27 01:57:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.233.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.237.8.37
description:
2025-01-27 01:58:00 dovecot_login authenticator failed for ([58.237.8.37]) [58.237.8.37]:36578: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 01:58:14 ait sshd[2584191]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.174.88.241
description:
2025-01-27 01:58:26 dovecot_plain authenticator failed for (177-174-88-241.user.vivozap.com.br) [177.174.88.241]:47430: 535 Incorrect authentication data (set_id=botchway@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.237.8.37
description:
Jan 27 01:57:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.237.8.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.170.189.164
description:
Jan 27 01:57:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.170.189.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.170.189.164
description:
2025-01-27 01:58:01 dovecot_login authenticator failed for ([79.170.189.164]) [79.170.189.164]:54165: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.151.65.155
description:
Jan 27 01:58:42 ait sshd[2584544]: pam_imunify(sshd:auth): [IM360_RBL] The IP 82.151.65.155 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.73.188.193
description:
[2025-01-27 01:58:44 +0100] info [webmaild] 187.73.188.193 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.67.154.24
description:
Jan 27 01:58:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.67.154.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.67.154.24
description:
2025-01-27 01:58:44 dovecot_plain authenticator failed for bzq-109-67-154-24.red.bezeqint.net [109.67.154.24]:59442: 535 Incorrect authentication data (set_id=botchway)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 01:59:15 ait sshd[2584751]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 01:59:15 ait sshd[2584751]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 82.151.65.155
description:
Jan 27 01:58:42 ait sshd[2584544]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=82.151.65.155  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.177.120.165
description:
Jan 27 01:59:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.177.120.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.230.100.252
description:
2025-01-27 02:00:01 dovecot_login authenticator failed for ([38.230.100.252]) [38.230.100.252]:58699: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Jan 27 02:00:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.18.20.150
description:
Jan 27 02:00:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.18.20.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.18.20.150
description:
2025-01-27 02:00:30 dovecot_plain authenticator failed for ([201.18.20.150]) [201.18.20.150]:59053: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.177.120.165
description:
2025-01-27 01:59:54 dovecot_plain authenticator failed for ([61.177.120.165]) [61.177.120.165]:34528: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.230.100.252
description:
Jan 27 01:59:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.230.100.252 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.87.30.40
description:
[2025-01-27 02:00:05 +0100] info [webmaild] 177.87.30.40 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-01-27 02:00:05 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:47332: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.106.126.27
description:
Jan 27 02:00:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.106.126.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.106.126.27
description:
2025-01-27 02:00:15 dovecot_login authenticator failed for ([211.106.126.27]) [211.106.126.27]:42561: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.23.241.161
description:
Jan 27 02:00:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.23.241.161 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.203.93
description:
2025-01-27 02:00:47 dovecot_plain authenticator failed for (m121-202-203-93.smartone.com) [121.202.203.93]:26161: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 27 02:00:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 02:00:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.185.130
description:
2025-01-27 02:00:32 dovecot_plain authenticator failed for ([59.46.185.130]) [59.46.185.130]:40007: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-27 02:00:36 dovecot_plain authenticator failed for ([121.202.152.13]) [121.202.152.13]:14850: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.128.211
description:
2025-01-27 02:00:35 dovecot_plain authenticator failed for ([112.27.128.211]) [112.27.128.211]:57267: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-27 02:00:53 dovecot_plain authenticator failed for (protopless) [65.20.183.209]:45062: 535 Incorrect authentication data (set_id=eng16b00239y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.205
description:
2025-01-27 02:00:59 dovecot_plain authenticator failed for (nsg-corporate-205.230.187.122.airtel.in) [122.187.230.205]:56574: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.123.40.94
description:
2025-01-27 02:00:40 dovecot_plain authenticator failed for (124.123.40.94.actcorp.in) [124.123.40.94]:1340: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.23.241.161
description:
2025-01-27 02:00:44 dovecot_plain authenticator failed for ([115.23.241.161]) [115.23.241.161]:42165: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.193.53.56
description:
Jan 27 02:00:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.193.53.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 27 02:00:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.211.250.122
description:
2025-01-27 02:00:46 dovecot_plain authenticator failed for ([190.211.250.118]) [190.211.250.122]:38945: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 27 02:00:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.205
description:
Jan 27 02:00:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.53.56
description:
2025-01-27 02:01:00 dovecot_login authenticator failed for ([113.193.53.56]) [113.193.53.56]:55850: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.115.112.77
description:
Jan 27 02:00:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.115.112.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.211.250.122
description:
Jan 27 02:00:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.211.250.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.185.130
description:
Jan 27 02:00:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.185.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.123.40.94
description:
Jan 27 02:00:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.123.40.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.203.93
description:
Jan 27 02:00:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.203.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-27 02:00:48 dovecot_login authenticator failed for ([103.103.35.130]) [103.103.35.130]:50994: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 02:01:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.128.211
description:
Jan 27 02:00:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.128.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.115.112.77
description:
2025-01-27 02:00:44 dovecot_plain authenticator failed for ([123.115.112.77]) [123.115.112.77]:50108: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 27 02:02:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-27 02:02:24 dovecot_login authenticator failed for ([103.48.194.21]) [103.48.194.21]:59878: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-27 02:02:13 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:41334: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.0.69.202
description:
2025-01-27 02:02:20 dovecot_plain authenticator failed for 191-0-69-202.host.telemar.net.br [191.0.69.202]:39308: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 138.122.83.148
description:
[2025-01-27 02:01:33 +0100] info [webmaild] 138.122.83.148 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.90.114
description:
Jan 27 02:01:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.90.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.89.116.5
description:
Jan 27 02:01:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.89.116.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.89.116.5
description:
2025-01-27 02:02:01 dovecot_plain authenticator failed for ([70.89.116.5]) [70.89.116.5]:47422: 535 Incorrect authentication data (set_id=abs68b66600y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.18.108
description:
2025-01-27 02:02:03 dovecot_plain authenticator failed for (h108-192-72-18.seed.net.tw) [192.72.18.108]:44751: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.247.207.98
description:
2025-01-27 02:01:50 dovecot_plain authenticator failed for ([114.247.207.98]) [114.247.207.98]:60559: 535 Incorrect authentication data (set_id=abs68b66600y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.90.114
description:
2025-01-27 02:01:52 dovecot_plain authenticator failed for ([58.18.90.114]) [58.18.90.114]:42413: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.72.18.108
description:
Jan 27 02:02:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.72.18.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.0.69.202
description:
Jan 27 02:02:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.0.69.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 27 02:02:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 87.175.176.13
description:
Jan 27 02:01:43 ait sshd[2585798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=87.175.176.13


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.247.207.98
description:
Jan 27 02:01:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.247.207.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.160.245.147
description:
2025-01-27 02:02:38 dovecot_plain authenticator failed for ([123.160.245.147]) [123.160.245.147]:55217: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.41.171
description:
2025-01-27 02:03:27 dovecot_plain authenticator failed for ([14.39.41.171]) [14.39.41.171]:58633: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.211.3
description:
2025-01-27 02:02:45 dovecot_plain authenticator failed for 82-64-211-3.subs.proxad.net [82.64.211.3]:57294: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
description:
Jan 27 02:02:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.205.82.33
description:
Jan 27 02:03:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.205.82.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.148.218.235
description:
2025-01-27 02:03:04 dovecot_plain authenticator failed for ([185.148.218.235]) [185.148.218.235]:52422: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.151.9.74
description:
Jan 27 02:03:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.151.9.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.160.245.147
description:
Jan 27 02:02:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.160.245.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.64.211.3
description:
Jan 27 02:02:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.64.211.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
description:
2025-01-27 02:02:53 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:48424: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.13
description:
Jan 27 02:03:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.13 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 173.212.229.187
domain: gvu.titopen.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:shedatowusua1234@gmail.com||WPU:shedatowusua1234@gmail.com||RSV:6.65||T:APACHE||MV:02-02.173.212.229.187


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.174.233.64
description:
Jan 27 02:02:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.174.233.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.220.235.237
description:
2025-01-27 02:02:55 dovecot_plain authenticator failed for ([112.220.235.237]) [112.220.235.237]:55360: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.174.233.64
description:
2025-01-27 02:02:58 dovecot_plain authenticator failed for h-158-174-233-64.a192.priv.bahnhof.se [158.174.233.64]:38102: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.82.33
description:
2025-01-27 02:03:04 dovecot_plain authenticator failed for ([94.205.82.33]) [94.205.82.33]:42890: 535 Incorrect authentication data (set_id=mappiah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.57.219.2
description:
2025-01-27 02:02:45 dovecot_plain authenticator failed for (94-43-224-106.dsl.utg.ge) [2.57.219.2]:54494: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.86.4
description:
Jan 27 02:02:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.86.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.151.9.74
description:
2025-01-27 02:03:14 dovecot_plain authenticator failed for (200151121049.user.veloxzone.com.br) [200.151.9.74]:35479: 535 Incorrect authentication data (set_id=mappiah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.170.28
description:
Jan 27 02:02:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.170.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.57.219.2
description:
Jan 27 02:02:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.57.219.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.39.41.171
description:
Jan 27 02:03:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.39.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
description:
2025-01-27 02:02:49 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:57799: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.220.235.237
description:
Jan 27 02:02:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.220.235.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.13
description:
2025-01-27 02:03:25 dovecot_login authenticator failed for (m121-202-152-13.smartone.com) [121.202.152.13]:22083: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.170.28
description:
2025-01-27 02:02:38 dovecot_login authenticator failed for ([103.207.170.28]) [103.207.170.28]:41444: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.148.218.235
description:
Jan 27 02:03:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.148.218.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.44.170.154
description:
2025-01-27 02:03:39 dovecot_plain authenticator failed for ([211.44.170.154]) [211.44.170.154]:51092: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.229.233.219
description:
Jan 27 02:03:41 ait sshd[2586930]: pam_imunify(sshd:auth): [IM360_RBL] The IP 156.229.233.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.44.170.154
description:
Jan 27 02:03:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.44.170.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 27 02:03:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-27 02:03:40 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:54047: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 156.229.233.219
description:
Jan 27 02:03:41 ait sshd[2586930]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=156.229.233.219


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.98.160.117
description:
2025-01-27 02:05:26 dovecot_plain authenticator failed for ([218.98.160.117]) [218.98.160.117]:62484: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 170.39.218.109
domain: mobile.ait-edu.us
description:
IM360 WAF: Bad file extension||RSV:6.65||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:titlemas||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.216.103.143
description:
[2025-01-27 02:05:30 +0100] info [webmaild] 201.216.103.143 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.133.207.119
description:
[2025-01-27 02:04:43 +0100] info [webmaild] 201.133.207.119 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.98.160.117
description:
Jan 27 02:05:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.98.160.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.233.177
description:
Jan 27 02:06:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.233.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.199.5.231
description:
Jan 27 02:05:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.199.5.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.5.231
description:
2025-01-27 02:05:38 dovecot_plain authenticator failed for ([211.199.5.231]) [211.199.5.231]:60882: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.228.92.193
description:
2025-01-27 02:06:02 dovecot_plain authenticator failed for broadband-5-228-92-193.ip.moscow.rt.ru [5.228.92.193]:56538: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Jan 27 02:06:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-01-27 02:06:12 dovecot_plain authenticator failed for ([200.205.133.193]) [187.8.163.70]:51321: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 27 02:06:08 ait sshd[2588121]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 27 02:06:08 ait sshd[2588121]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.233.177
description:
2025-01-27 02:06:26 dovecot_plain authenticator failed for (nsg-corporate-177.233.187.122.airtel.in) [122.187.233.177]:59881: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.130.227.80
description:
Jan 27 02:05:33 ait sshd[2587909]: pam_imunify(sshd:auth): [IM360_RBL] The IP 95.130.227.80 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 95.130.227.80
description:
Jan 27 02:05:33 ait sshd[2587909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=95.130.227.80  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.228.92.193
description:
Jan 27 02:06:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.228.92.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.57.106
description:
Jan 27 02:06:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.57.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.57.106
description:
2025-01-27 02:06:15 dovecot_plain authenticator failed for ([65.76.57.106]) [65.76.57.106]:40348: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.236.175.122
description:
2025-01-27 02:06:37 dovecot_plain authenticator failed for ([120.236.175.122]) [120.236.175.122]:33684: 535 Incorrect authentication data (set_id=bscs18bit0021y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.143.206
description:
2025-01-27 02:06:58 dovecot_plain authenticator failed for ([112.194.143.206]) [112.194.143.206]:37362: 535 Incorrect authentication data (set_id=bscs18bit0021y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.167.56.2
description:
Jan 27 02:07:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.167.56.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.143.206
description:
Jan 27 02:06:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.143.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.167.56.2
description:
2025-01-27 02:07:06 dovecot_plain authenticator failed for ([185.167.56.2]) [185.167.56.2]:32878: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.195.205.236
description:
Jan 27 02:07:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.195.205.236 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 69.30.195.178
domain: www.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-06.69.30.195.178


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.236.175.122
description:
Jan 27 02:06:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.236.175.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 02:06:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.197.252.18
description:
[2025-01-27 02:07:26 +0100] info [webmaild] 177.197.252.18 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.195.205.236
description:
2025-01-27 02:07:30 dovecot_plain authenticator failed for ([175.195.205.236]) [175.195.205.236]:45108: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.134.19.99
description:
Jan 27 02:07:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.134.19.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.10.127.167
description:
Jan 27 02:08:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.10.127.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 27 02:08:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-27 02:08:20 dovecot_plain authenticator failed for (mintinnity) [77.239.255.163]:45494: 535 Incorrect authentication data (set_id=ads17b00155y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.211.47.66
description:
Jan 27 02:08:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.211.47.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.211.47.66
description:
2025-01-27 02:08:25 dovecot_plain authenticator failed for ([197.211.47.66]) [197.211.47.66]:46919: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.117.0.253
description:
2025-01-27 02:07:46 dovecot_plain authenticator failed for ([222.117.0.253]) [222.117.0.253]:57265: 535 Incorrect authentication data (set_id=eng19a00089y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
description:
2025-01-27 02:07:49 dovecot_plain authenticator failed for ([14.54.22.11]) [14.54.22.11]:58988: 535 Incorrect authentication data (set_id=ads21b00225y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.166
description:
Jan 27 02:08:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.147.6.84
description:
Jan 27 02:08:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.147.6.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.19.99
description:
2025-01-27 02:07:39 dovecot_plain authenticator failed for (78-134-19-99.static.eolo.it) [78.134.19.99]:47239: 535 Incorrect authentication data (set_id=ads21b00225y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.117.0.253
description:
Jan 27 02:07:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.117.0.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.159.173.105
description:
2025-01-27 02:08:16 dovecot_plain authenticator failed for (choritrot) [5.159.173.105]:53484: 535 Incorrect authentication data (set_id=21m1150009@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
description:
Jan 27 02:07:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.10.127.167
description:
2025-01-27 02:08:03 dovecot_plain authenticator failed for ([116.10.127.167]) [116.10.127.167]:55089: 535 Incorrect authentication data (set_id=eng19a00089y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.159.173.105
description:
Jan 27 02:08:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.159.173.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.166
description:
2025-01-27 02:08:23 dovecot_plain authenticator failed for ([1.31.80.166]) [1.31.80.166]:52589: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 27 02:08:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.3.227.158
description:
2025-01-27 02:08:39 dovecot_login authenticator failed for p7001159-ipoefx.ipoe.ocn.ne.jp [118.3.227.158]:55672: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.194.243.187
description:
2025-01-27 02:08:41 dovecot_plain authenticator failed for ([103.194.243.187]) [103.194.243.187]:41189: 535 Incorrect authentication data (set_id=fusheini)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 02:09:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.77.182.171
description:
Jan 27 02:08:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.77.182.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.182.171
description:
2025-01-27 02:08:35 dovecot_plain authenticator failed for ([220.77.182.171]) [220.77.182.171]:43113: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.3.227.158
description:
Jan 27 02:08:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.3.227.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.148.95.217
description:
Jan 27 02:08:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.148.95.217 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.95.217
description:
2025-01-27 02:08:53 dovecot_plain authenticator failed for ([38.148.95.217]) [38.148.95.217]:58855: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.148.248.242
description:
Jan 27 02:08:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.148.248.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-27 02:08:41 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:50408: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.148.248.242
description:
2025-01-27 02:08:41 dovecot_plain authenticator failed for ([117.148.248.242]) [117.148.248.242]:37210: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.147.6.84
description:
2025-01-27 02:08:32 dovecot_plain authenticator failed for ([218.147.6.84]) [218.147.6.84]:43392: 535 Incorrect authentication data (set_id=fusheini@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.194.243.187
description:
Jan 27 02:08:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.194.243.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.127
description:
Jan 27 02:08:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.127
description:
2025-01-27 02:08:55 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.127]:50510: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 02:09:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.233.251
description:
Jan 27 02:10:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.233.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
description:
2025-01-27 02:10:05 dovecot_login authenticator failed for 5.185.233.251.ipv4.public.orange.pl [5.185.233.251]:59624: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 27 02:10:26 ait sshd[2590331]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.154.207.10
description:
Jan 27 02:09:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.154.207.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.207.10
description:
2025-01-27 02:10:01 dovecot_plain authenticator failed for 213-154-207-10.static.vega-ua.net [213.154.207.10]:56800: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.44.5
description:
2025-01-27 02:10:11 dovecot_plain authenticator failed for ([165.16.44.5]) [165.16.44.5]:55545: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 27 02:10:26 ait sshd[2590331]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 86.104.144.93
description:
Jan 27 02:09:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 86.104.144.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.104.144.93
description:
2025-01-27 02:09:55 dovecot_login authenticator failed for ([86.104.144.93]) [86.104.144.93]:39294: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.16.44.5
description:
Jan 27 02:10:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.16.44.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.52.131.183
description:
Jan 27 02:10:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.52.131.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.52.131.183
description:
2025-01-27 02:10:22 dovecot_plain authenticator failed for ([211.52.131.183]) [211.52.131.183]:51652: 535 Incorrect authentication data (set_id=ads22b00265y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 02:11:07 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:5632: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.224.58.243
description:
Jan 27 02:11:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.224.58.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.224.58.243
description:
2025-01-27 02:11:24 dovecot_plain authenticator failed for ([1.224.58.243]) [1.224.58.243]:33221: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.8.167.241
description:
2025-01-27 02:10:48 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:45862: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.253.10.61
description:
Jan 27 02:10:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.253.10.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 182.189.61.205
description:
[2025-01-27 02:11:21 +0100] info [webmaild] 182.189.61.205 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.6.69.226
description:
2025-01-27 02:11:11 dovecot_plain authenticator failed for ([221.6.69.226]) [221.6.69.226]:52426: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.244.246.221
description:
Jan 27 02:11:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.244.246.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.225.203.106
description:
Jan 27 02:10:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.225.203.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 02:10:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.35.188.202
description:
Jan 27 02:10:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.35.188.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
description:
Jan 27 02:10:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.168.26.166
description:
2025-01-27 02:10:48 dovecot_plain authenticator failed for syn-024-168-026-166.res.spectrum.com [24.168.26.166]:36388: 535 Incorrect authentication data (set_id=eng29b00328y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.253.10.61
description:
2025-01-27 02:10:50 dovecot_plain authenticator failed for ([211.253.10.61]) [211.253.10.61]:40559: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 02:11:01 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:34206: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.157.111
description:
2025-01-27 02:11:05 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.157.111]:35837: 535 Incorrect authentication data (set_id=vondee)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 02:11:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.204.162.116
description:
Jan 27 02:11:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.204.162.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.53.178.132
description:
Jan 27 02:10:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.53.178.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.182.162
description:
Jan 27 02:10:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.182.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.250
description:
Jan 27 02:11:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.244.246.221
description:
2025-01-27 02:11:19 dovecot_plain authenticator failed for ([1.244.246.221]) [1.244.246.221]:58266: 535 Incorrect authentication data (set_id=eng29b00328y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.204.162.116
description:
2025-01-27 02:11:21 dovecot_plain authenticator failed for ([82.204.162.116]) [82.204.162.116]:49832: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.134.3.252
description:
2025-01-27 02:11:00 dovecot_login authenticator failed for syn-072-134-003-252.res.spectrum.com [72.134.3.252]:42900: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.157.111
description:
Jan 27 02:11:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.157.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.6.69.226
description:
Jan 27 02:11:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.6.69.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.225.203.106
description:
2025-01-27 02:10:37 dovecot_plain authenticator failed for ([122.225.203.106]) [122.225.203.106]:24676: 535 Incorrect authentication data (set_id=vondee@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.35.188.202
description:
2025-01-27 02:10:43 dovecot_plain authenticator failed for 202-188-035-194.ip-addr.vsenet.de [194.35.188.202]:47133: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.168.26.166
description:
Jan 27 02:10:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.168.26.166 has been locked due to Imunify RBL


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-10.65.0.27.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.134.3.252
description:
Jan 27 02:10:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.134.3.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.53.178.132
description:
2025-01-27 02:10:33 dovecot_plain authenticator failed for (132-178-53-194.mairnet.net) [194.53.178.132]:34580: 535 Incorrect authentication data (set_id=ads22b00265y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.182.162
description:
2025-01-27 02:10:34 dovecot_plain authenticator failed for ([61.83.232.94]) [221.163.182.162]:54265: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.246.49.99
description:
2025-01-27 02:11:45 dovecot_plain authenticator failed for (abts-mp-static-185.120.168.122.airtelbroadband.in) [115.246.49.99]:47660: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.168.60.146
description:
Jan 27 02:11:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.168.60.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.168.60.146
description:
2025-01-27 02:11:51 dovecot_plain authenticator failed for ([180.168.60.146]) [180.168.60.146]:34291: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.143.166
description:
2025-01-27 02:11:52 dovecot_plain authenticator failed for 166.143.48.116.static.netvigator.com [116.48.143.166]:59434: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Jan 27 02:11:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-01-27 02:12:01 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:54645: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.227.219.90
description:
Jan 27 02:11:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.227.219.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.227.219.90
description:
2025-01-27 02:12:01 dovecot_plain authenticator failed for (pretion) [185.227.219.90]:37468: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.78
description:
Jan 27 02:11:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.246.49.99
description:
Jan 27 02:11:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.246.49.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.48.143.166
description:
Jan 27 02:11:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.48.143.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.94.0.159
description:
Jan 27 02:12:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.94.0.159 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.69.9.250
description:
2025-01-27 02:11:31 dovecot_plain authenticator failed for ([103.69.9.250]) [103.69.9.250]:50830: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.78
description:
2025-01-27 02:11:41 dovecot_plain authenticator failed for ([122.187.246.78]) [122.187.246.78]:50324: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.82.122.234
description:
Jan 27 02:11:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.82.122.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.82.122.234
description:
2025-01-27 02:11:54 dovecot_plain authenticator failed for ([59.93.107.33]) [119.82.122.234]:57398: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.94.0.159
description:
2025-01-27 02:12:19 dovecot_plain authenticator failed for 116-94-0-159.ppps.bbiq.jp [116.94.0.159]:10007: 535 Incorrect authentication data (set_id=ads21b00213y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.12.117
description:
2025-01-27 02:13:00 dovecot_plain authenticator failed for 111-70-12-117.emome-ip.hinet.net [111.70.12.117]:35161: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.20.26.201
description:
Jan 27 02:13:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.20.26.201 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.209
description:
2025-01-27 02:13:16 dovecot_login authenticator failed for ([154.144.255.209]) [154.144.255.209]:57498: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.26.201
description:
2025-01-27 02:13:17 dovecot_plain authenticator failed for 211-20-26-201.hinet-ip.hinet.net [211.20.26.201]:59998: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.6.102.11
description:
Jan 27 02:12:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.6.102.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.6.102.11
description:
2025-01-27 02:12:59 dovecot_plain authenticator failed for ([183.6.102.11]) [183.6.102.11]:30080: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.19.80.138
description:
Jan 27 02:13:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.19.80.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.245.207.104
description:
2025-01-27 02:12:49 dovecot_plain authenticator failed for ([1.245.207.104]) [1.245.207.104]:51209: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.209
description:
Jan 27 02:13:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.12.117
description:
Jan 27 02:12:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.12.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.19.80.138
description:
2025-01-27 02:13:10 dovecot_plain authenticator failed for syn-156-019-080-138.biz.spectrum.com [156.19.80.138]:48403: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.40.155
description:
Jan 27 02:13:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.40.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.31.80.222
description:
Jan 27 02:12:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.31.80.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.31.80.222
description:
2025-01-27 02:12:36 dovecot_plain authenticator failed for ([1.31.80.222]) [1.31.80.222]:55168: 535 Incorrect authentication data (set_id=ads21b00213y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.245.207.104
description:
Jan 27 02:12:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.245.207.104 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 02:13:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.224.130.161
description:
[2025-01-27 02:13:46 +0100] info [webmaild] 186.224.130.161 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.225.169
description:
2025-01-27 02:14:03 dovecot_plain authenticator failed for net-2-37-225-169.cust.vodafonedsl.it (crastate) [2.37.225.169]:42531: 535 Incorrect authentication data (set_id=phd@iric.us)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.166.179.34
description:
2025-01-27 02:14:20 dovecot_plain authenticator failed for ([188.166.179.34]) [188.166.179.34]:43184: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.44.209.199
description:
2025-01-27 02:14:27 dovecot_plain authenticator failed for ([177.44.209.199]) [177.44.209.199]:47452: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.40.155
description:
2025-01-27 02:13:30 dovecot_login authenticator failed for ([60.174.40.155]) [60.174.40.155]:47858: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 106.225.167.89
description:
Jan 27 02:14:04 ait sshd[2592184]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=106.225.167.89  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.226.142.114
description:
2025-01-27 02:14:16 dovecot_plain authenticator failed for ([221.226.142.114]) [221.226.142.114]:51418: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.52.253.175
description:
2025-01-27 02:14:00 dovecot_plain authenticator failed for ([111.52.253.175]) [111.52.253.175]:39642: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.226.142.114
description:
Jan 27 02:14:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.226.142.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.166.179.34
description:
Jan 27 02:14:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.166.179.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 02:13:34 dovecot_plain authenticator failed for ([203.81.213.46]) [203.81.213.46]:55576: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 02:13:49 ait sshd[2592117]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.52.253.175
description:
Jan 27 02:13:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.52.253.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.0.60.158
description:
Jan 27 02:14:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.0.60.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.53.129.92
description:
Jan 27 02:13:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.53.129.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.53.129.92
description:
2025-01-27 02:13:48 dovecot_plain authenticator failed for ([111.53.129.92]) [111.53.129.92]:35814: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 02:13:49 ait sshd[2592117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.225.167.89
description:
Jan 27 02:14:04 ait sshd[2592184]: pam_imunify(sshd:auth): [IM360_RBL] The IP 106.225.167.89 has been locked due to Imunify RBL


plugin: ossec
rule: 1010
name: Process segfaulted.
description:
Jan 27 02:13:42 ait kernel: php[2592077]: segfault at 0 ip 000014956cd93b8a sp 00007ffeff835a40 error 4 in i360.so[14956cd70000+d5000]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.225.169
description:
Jan 27 02:14:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.225.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.60.158
description:
2025-01-27 02:14:17 dovecot_plain authenticator failed for ([59.0.60.158]) [59.0.60.158]:36094: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.209.199
description:
Jan 27 02:14:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.209.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.45.114.161
description:
Jan 27 02:14:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.45.114.161 has been locked due to Imunify RBL


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 84.239.41.10
domain: www.ait-edu.us
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:panscient.com||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.216
description:
Jan 27 02:15:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.216
description:
2025-01-27 02:15:17 dovecot_login authenticator failed for ([195.178.110.216]) [195.178.110.216]:49313: 535 Incorrect authentication data (set_id=scanner)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.45.114.161
description:
2025-01-27 02:14:57 dovecot_plain authenticator failed for 121-45-114-161.tpgi.com.au [121.45.114.161]:45188: 535 Incorrect authentication data (set_id=ads20a00164y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.51.242.119
description:
Jan 27 02:14:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.51.242.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 02:14:35 ait sshd[2592437]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.204.52.137
description:
Jan 27 02:14:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.204.52.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.103.35.130
description:
Jan 27 02:14:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.103.35.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.51.242.119
description:
2025-01-27 02:14:32 dovecot_plain authenticator failed for ([58.244.99.85]) [119.51.242.119]:38438: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.98
description:
Jan 27 02:14:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.241.214.127
description:
Jan 27 02:14:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.241.214.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.183.70
description:
2025-01-27 02:14:56 dovecot_plain authenticator failed for ([39.165.183.70]) [39.165.183.70]:53594: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 02:14:35 ait sshd[2592437]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.183.70
description:
Jan 27 02:14:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.183.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.215.21.164
description:
2025-01-27 02:15:04 dovecot_plain authenticator failed for (dynamicip-176-215-21-164.pppoe.ekat.ertelecom.ru) [176.215.21.164]:51900: 535 Incorrect authentication data (set_id=ads20a00164y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.98
description:
2025-01-27 02:14:37 dovecot_login authenticator failed for ([5.32.107.98]) [5.32.107.98]:48433: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.204.52.137
description:
2025-01-27 02:14:41 dovecot_plain authenticator failed for ([88.204.52.137]) [88.204.52.137]:60986: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.241.214.127
description:
2025-01-27 02:14:45 dovecot_plain authenticator failed for ([223.241.214.127]) [223.241.214.127]:44691: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-27 02:14:51 dovecot_login authenticator failed for (host-130-35-103-103.xlinkbd.net) [103.103.35.130]:50644: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 27 02:15:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-27 02:15:29 dovecot_plain authenticator failed for (hostglobal.plus) [78.153.140.202]:36728: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.163.227.238
description:
Jan 27 02:14:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.163.227.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.163.227.238
description:
2025-01-27 02:14:33 dovecot_plain authenticator failed for ([221.163.227.238]) [221.163.227.238]:44652: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.215.21.164
description:
Jan 27 02:15:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.215.21.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.162.227
description:
2025-01-27 02:15:55 dovecot_plain authenticator failed for broadband-178-140-162-227.ip.moscow.rt.ru [178.140.162.227]:51432: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.163.70
description:
Jan 27 02:16:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.163.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 69.124.10.62
description:
Jan 27 02:15:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 69.124.10.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.128.181.121
description:
Jan 27 02:15:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.128.181.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.124.10.62
description:
2025-01-27 02:15:56 dovecot_plain authenticator failed for ool-457c0a3e.dyn.optonline.net [69.124.10.62]:56970: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.249.162
description:
Jan 27 02:16:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.249.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.200.249.162
description:
2025-01-27 02:16:06 dovecot_plain authenticator failed for ([186.200.8.115]) [186.200.249.162]:33180: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.14.33
description:
Jan 27 02:15:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.14.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.14.33
description:
2025-01-27 02:15:32 dovecot_plain authenticator failed for ([59.2.14.33]) [59.2.14.33]:55800: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.153.140.202
description:
2025-01-27 02:15:35 dovecot_login authenticator failed for (hostglobal.plus) [78.153.140.202]:36728: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.128.181.121
description:
2025-01-27 02:15:43 dovecot_plain authenticator failed for ([203.128.181.121]) [203.128.181.121]:58322: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.112.71.128
description:
Jan 27 02:15:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.112.71.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.140.162.227
description:
Jan 27 02:15:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.140.162.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.163.70
description:
2025-01-27 02:16:02 dovecot_plain authenticator failed for (187-8-163-70.customer.tdatabrasil.net.br) [187.8.163.70]:48272: 535 Incorrect authentication data (set_id=abs32a11154y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.153.140.202
description:
Jan 27 02:15:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.153.140.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.207.254.114
description:
2025-01-27 02:16:04 dovecot_plain authenticator failed for static-138-207-254-114.paw.cpe.atlanticbb.net [138.207.254.114]:37535: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.207.254.114
description:
Jan 27 02:16:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.207.254.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.112.71.128
description:
2025-01-27 02:15:52 dovecot_plain authenticator failed for syn-070-112-071-128.res.spectrum.com [70.112.71.128]:48538: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.215
description:
2025-01-27 02:16:48 dovecot_login authenticator failed for ([195.178.110.215]) [195.178.110.215]:53570: 535 Incorrect authentication data (set_id=guest)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.52.204.227
description:
Jan 27 02:16:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.52.204.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.215
description:
Jan 27 02:16:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.48.214.96
description:
Jan 27 02:17:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.48.214.96 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.48.214.96
description:
2025-01-27 02:17:16 dovecot_plain authenticator failed for ([111.48.214.96]) [111.48.214.96]:54726: 535 Incorrect authentication data (set_id=ads19b00282y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.6.235.62
description:
Jan 27 02:17:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.6.235.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.6.235.62
description:
2025-01-27 02:17:20 dovecot_plain authenticator failed for ([179.252.107.105]) [177.6.235.62]:59060: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.52.204.227
description:
2025-01-27 02:17:00 dovecot_plain authenticator failed for ([46.52.204.227]) [46.52.204.227]:51480: 535 Incorrect authentication data (set_id=ads19b00282y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.91.124.4
description:
Jan 27 02:17:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.91.124.4 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.66.204.186
description:
[2025-01-27 02:18:03 +0100] info [webmaild] 186.66.204.186 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 02:18:06 ait sshd[2593984]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.206.7.126
description:
Jan 27 02:17:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.206.7.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.91.124.4
description:
2025-01-27 02:17:54 dovecot_login authenticator failed for ([112.91.124.4]) [112.91.124.4]:38475: 535 Incorrect authentication data (set_id=suvie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.58.118
description:
2025-01-27 02:17:36 dovecot_plain authenticator failed for ([61.76.58.118]) [61.76.58.118]:38076: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.103.47.67
description:
[2025-01-27 02:17:53 +0100] info [webmaild] 200.103.47.67 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 02:17:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 27 02:18:06 ait sshd[2593984]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.76.58.118
description:
Jan 27 02:17:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.76.58.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.206.7.126
description:
2025-01-27 02:17:42 dovecot_login authenticator failed for ([221.206.7.126]) [221.206.7.126]:54813: 535 Incorrect authentication data (set_id=suvie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.249.234.242
description:
Jan 27 02:18:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.249.234.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.71.166
description:
2025-01-27 02:18:52 dovecot_plain authenticator failed for 83-233-71-166.cust.bredband2.com [83.233.71.166]:39450: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.42.133.74
description:
Jan 27 02:19:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.42.133.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
description:
2025-01-27 02:18:33 dovecot_plain authenticator failed for ([200.106.49.149]) [200.106.49.149]:36380: 535 Incorrect authentication data (set_id=gyn@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.175.115
description:
2025-01-27 02:18:44 dovecot_plain authenticator failed for (static.as64098.net) [103.79.175.115]:58208: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.71.166
description:
Jan 27 02:18:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.71.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.42.133.74
description:
2025-01-27 02:19:09 dovecot_plain authenticator failed for ([61.42.133.74]) [61.42.133.74]:46198: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.151
description:
Jan 27 02:19:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.249.234.242
description:
2025-01-27 02:18:41 dovecot_plain authenticator failed for pool-96-249-234-242.nrflva.fios.verizon.net [96.249.234.242]:45952: 535 Incorrect authentication data (set_id=gyn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.79.175.115
description:
Jan 27 02:18:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.79.175.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.18.190.5
description:
[2025-01-27 02:19:13 +0100] info [webmaild] 177.18.190.5 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.151
description:
2025-01-27 02:19:29 dovecot_plain authenticator failed for ([36.134.78.151]) [36.134.78.151]:40627: 535 Incorrect authentication data (set_id=eng20b00215y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.106.49.149
description:
Jan 27 02:18:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.106.49.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.154.90.47
description:
Jan 27 02:19:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.154.90.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.154.90.47
description:
2025-01-27 02:19:22 dovecot_plain authenticator failed for ([121.154.90.47]) [121.154.90.47]:34522: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.24.107
description:
2025-01-27 02:19:33 dovecot_plain authenticator failed for vps-79f20bfc.vps.ovh.net ([87.98.249.193]) [51.75.24.107]:41389: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 02:20:09 ait sshd[2594871]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.188.162.179
description:
Jan 27 02:20:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.188.162.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.249.207.53
description:
Jan 27 02:20:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.249.207.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.151.238.195
description:
Jan 27 02:19:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.151.238.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.190.129.68
description:
2025-01-27 02:19:44 dovecot_plain authenticator failed for ([121.190.129.68]) [121.190.129.68]:33424: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.152.225.58
description:
2025-01-27 02:20:13 dovecot_plain authenticator failed for net-188-152-225-58.cust.vodafonedsl.it [188.152.225.58]:47727: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.176.72.55
description:
[2025-01-27 02:19:47 +0100] info [webmaild] 181.176.72.55 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.188.162.179
description:
2025-01-27 02:20:25 dovecot_plain authenticator failed for ([64.188.162.179]) [64.188.162.179]:32804: 535 Incorrect authentication data (set_id=jkudzie@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
description:
2025-01-27 02:20:30 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:36948: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.24.107
description:
Jan 27 02:19:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.24.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.151.238.195
description:
2025-01-27 02:19:39 dovecot_plain authenticator failed for ([91.151.238.195]) [91.151.238.195]:41311: 535 Incorrect authentication data (set_id=eng20b00215y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.190.129.68
description:
Jan 27 02:19:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.190.129.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 02:20:09 ait sshd[2594871]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.152.225.58
description:
Jan 27 02:20:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.152.225.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.252.103
description:
Jan 27 02:21:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.252.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.130.174.76
description:
2025-01-27 02:20:34 dovecot_plain authenticator failed for host81-130-174-76.in-addr.btopenworld.com [81.130.174.76]:60136: 535 Incorrect authentication data (set_id=jkudzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.45.76.149
description:
Jan 27 02:20:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.45.76.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.45.76.149
description:
2025-01-27 02:20:50 dovecot_plain authenticator failed for ip-4c95.sunline.net.ua (dogar) [94.45.76.149]:42215: 535 Incorrect authentication data (set_id=ads14b00350y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.18.64.54
description:
Jan 27 02:20:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.18.64.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.252.103
description:
2025-01-27 02:21:18 dovecot_plain authenticator failed for ([183.230.252.103]) [183.230.252.103]:50486: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.130.174.76
description:
Jan 27 02:20:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.130.174.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.18.64.54
description:
2025-01-27 02:20:33 dovecot_plain authenticator failed for ([58.18.64.54]) [58.18.64.54]:53183: 535 Incorrect authentication data (set_id=ads20a00130y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.41.171
description:
2025-01-27 02:20:45 dovecot_plain authenticator failed for 171.41.246.220.static.netvigator.com [220.246.41.171]:63384: 535 Incorrect authentication data (set_id=ads20a00130y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.212.225.99
description:
Jan 27 02:21:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.212.225.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.212.225.99
description:
2025-01-27 02:21:07 dovecot_plain authenticator failed for ([1.212.225.99]) [1.212.225.99]:50480: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.41.171
description:
Jan 27 02:20:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.41.171 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.226.100.114
description:
[2025-01-27 02:21:06 +0100] info [webmaild] 177.226.100.114 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 200.8.191.50
description:
[2025-01-27 02:21:20 +0100] info [webmaild] 200.8.191.50 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.26.64
description:
Jan 27 02:21:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.26.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.76.248.54
description:
2025-01-27 02:22:03 dovecot_login authenticator failed for ([222.76.248.54]) [222.76.248.54]:50806: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 02:22:10 dovecot_login authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:4071: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
description:
2025-01-27 02:22:26 dovecot_login authenticator failed for ([49.246.68.220]) [49.246.68.220]:33470: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.129.62.15
description:
2025-01-27 02:22:20 dovecot_login authenticator failed for (yash-static-15.62.129.150.yashtel.co.in) [150.129.62.15]:36946: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-27 02:22:30 dovecot_login authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:57405: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.126.196.67
description:
2025-01-27 02:21:46 dovecot_login authenticator failed for (cli-5b7ec443.ast.adamo.es) [91.126.196.67]:51052: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.122.157.193
description:
Jan 27 02:21:55 ait sshd[2595624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.122.157.193  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 02:22:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.134
description:
Jan 27 02:22:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.134
description:
2025-01-27 02:22:14 dovecot_login authenticator failed for (m121-202-152-134.smartone.com) [121.202.152.134]:1926: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.68.220
description:
Jan 27 02:22:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.68.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 27 02:22:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.126.196.67
description:
Jan 27 02:21:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.126.196.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.122.157.193
description:
Jan 27 02:21:55 ait sshd[2595624]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.122.157.193 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.71.26.64
description:
2025-01-27 02:21:59 dovecot_login authenticator failed for ([27.71.26.64]) [27.71.26.64]:49528: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
description:
Jan 27 02:22:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.116.116.103
description:
[2025-01-27 02:22:07 +0100] info [webmaild] 179.116.116.103 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 150.129.62.15
description:
Jan 27 02:22:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 150.129.62.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.197.172.72
description:
Jan 27 02:22:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.197.172.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.85
description:
Jan 27 02:23:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.168.235
description:
Jan 27 02:23:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.168.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.42.100
description:
Jan 27 02:23:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.42.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.42.100
description:
2025-01-27 02:23:21 dovecot_login authenticator failed for 111-70-42-100.emome-ip.hinet.net [111.70.42.100]:53651: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.230.64.246
description:
Jan 27 02:23:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.230.64.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.85
description:
2025-01-27 02:23:06 dovecot_login authenticator failed for ([104.241.228.85]) [104.241.228.85]:39714: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.86.4
description:
Jan 27 02:23:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.86.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.86.4
description:
2025-01-27 02:23:21 dovecot_login authenticator failed for ([60.174.86.4]) [60.174.86.4]:48244: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.64.246
description:
2025-01-27 02:23:06 dovecot_plain authenticator failed for ([213.230.64.246]) [213.230.64.246]:34176: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.172.72
description:
2025-01-27 02:22:57 dovecot_plain authenticator failed for (223-197-172-72.static.imsbiz.com) [223.197.172.72]:61479: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.168.235
description:
2025-01-27 02:23:16 dovecot_plain authenticator failed for (pinate) [65.20.168.235]:56607: 535 Incorrect authentication data (set_id=eng20a00103y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.203.229.200
description:
[2025-01-27 02:23:22 +0100] info [webmaild] 94.203.229.200 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.233.242.245
description:
Jan 27 02:23:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.233.242.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.233.242.245
description:
2025-01-27 02:23:30 dovecot_login authenticator failed for 83-233-242-245.cust.bredband2.com [83.233.242.245]:57210: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.58
description:
2025-01-27 02:24:08 dovecot_login authenticator failed for ([111.61.176.58]) [111.61.176.58]:25026: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.183.209
description:
2025-01-27 02:24:14 dovecot_plain authenticator failed for (gling) [65.20.183.209]:59804: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 27 02:23:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.123.78.13
description:
Jan 27 02:23:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.123.78.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-27 02:23:56 dovecot_login authenticator failed for ([102.53.15.54]) [102.53.15.54]:35804: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.58
description:
Jan 27 02:24:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.241.159
description:
2025-01-27 02:24:09 dovecot_plain authenticator failed for ([60.221.241.159]) [60.221.241.159]:36849: 535 Incorrect authentication data (set_id=ofei)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 02:24:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.123.78.13
description:
2025-01-27 02:23:59 dovecot_plain authenticator failed for (12-78-123-185.host.cirex.ru) [185.123.78.13]:41153: 535 Incorrect authentication data (set_id=ofei@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.241.159
description:
Jan 27 02:24:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.241.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.183.209
description:
Jan 27 02:24:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.183.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.173
description:
Jan 27 02:24:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.220.154.126
description:
Jan 27 02:25:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.220.154.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.222.166.212
description:
Jan 27 02:24:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.222.166.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.222.166.212
description:
2025-01-27 02:24:44 dovecot_login authenticator failed for (180-222-166-212.static.dsl.net.au) [180.222.166.212]:38117: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.31.167.120
description:
Jan 27 02:24:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.31.167.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.155.91
description:
Jan 27 02:25:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.155.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.213.207.3
description:
2025-01-27 02:25:08 dovecot_plain authenticator failed for ([102.213.207.3]) [102.213.207.3]:38068: 535 Incorrect authentication data (set_id=ads22a00059y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.237.110.29
description:
Jan 27 02:25:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.237.110.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.110.29
description:
2025-01-27 02:25:16 dovecot_plain authenticator failed for 81-237-110-29-no2300.tbcn.telia.com (sleve) [81.237.110.29]:43322: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.154.126
description:
2025-01-27 02:25:28 dovecot_plain authenticator failed for (165-220-154-126.cust.exede.net) [165.220.154.126]:33726: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.198.73
description:
Jan 27 02:24:30 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.198.73 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.31.167.120
description:
2025-01-27 02:24:48 dovecot_plain authenticator failed for ([112.31.167.120]) [112.31.167.120]:49547: 535 Incorrect authentication data (set_id=ads23a00018y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.173
description:
2025-01-27 02:24:58 dovecot_login authenticator failed for (m121-202-154-173.smartone.com) [121.202.154.173]:17628: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.155.91
description:
2025-01-27 02:25:05 dovecot_plain authenticator failed for (upessenis) [65.20.155.91]:59020: 535 Incorrect authentication data (set_id=dhdvn@iric.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.213.207.3
description:
Jan 27 02:25:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.213.207.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.243.43.30
description:
Jan 27 02:24:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.243.43.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.243.43.30
description:
2025-01-27 02:24:37 dovecot_plain authenticator failed for ([211.243.43.30]) [211.243.43.30]:50824: 535 Incorrect authentication data (set_id=ads23a00018y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.51.218
description:
2025-01-27 02:25:55 dovecot_login authenticator failed for ([94.102.51.218]) [94.102.51.218]:43108: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.235.170
description:
2025-01-27 02:26:02 dovecot_login authenticator failed for ([104.241.235.170]) [104.241.235.170]:36806: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.151.168.237
description:
Jan 27 02:26:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.151.168.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.167.241
description:
Jan 27 02:25:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.167.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.200.227.194
description:
Jan 27 02:25:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.200.227.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.200.227.194
description:
2025-01-27 02:25:40 dovecot_plain authenticator failed for ([196.200.227.78]) [196.200.227.194]:35944: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.155.170.146
description:
Jan 27 02:25:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.155.170.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.43.30.3
description:
Jan 27 02:25:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.43.30.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.54
description:
Jan 27 02:26:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.201
description:
2025-01-27 02:26:07 dovecot_plain authenticator failed for (m121-202-198-201.smartone.com) [121.202.198.201]:1906: 535 Incorrect authentication data (set_id=bsemaha@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.205.16.169
description:
[2025-01-27 02:26:28 +0100] info [webmaild] 186.205.16.169 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.8.167.241
description:
2025-01-27 02:25:37 dovecot_login authenticator failed for (186-201-10-10.customer.tdatabrasil.net.br) [177.8.167.241]:6468: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.30.3
description:
2025-01-27 02:25:39 dovecot_login authenticator failed for ([118.43.30.3]) [118.43.30.3]:38906: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.155.170.146
description:
2025-01-27 02:25:51 dovecot_plain authenticator failed for ([39.155.170.146]) [39.155.170.146]:58291: 535 Incorrect authentication data (set_id=ads22a00059y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.198.201
description:
Jan 27 02:26:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.198.201 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.213.109.126
description:
Jan 27 02:25:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.213.109.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.51.218
description:
Jan 27 02:25:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.51.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.54
description:
2025-01-27 02:26:09 dovecot_plain authenticator failed for (moder) [102.53.15.54]:60052: 535 Incorrect authentication data (set_id=ads21a00012y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.168.237
description:
2025-01-27 02:26:18 dovecot_plain authenticator failed for ([221.151.168.237]) [221.151.168.237]:45520: 535 Incorrect authentication data (set_id=bsemaha)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 02:26:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 02:27:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.204.230.214
description:
Jan 27 02:28:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.204.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 02:29:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.117.118
description:
2025-01-27 02:29:23 dovecot_plain authenticator failed for 118.sub-166-169-117.myvzw.com [166.169.117.118]:4459: 535 Incorrect authentication data (set_id=ads20b00324y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.230.214
description:
2025-01-27 02:28:48 dovecot_plain authenticator failed for ([94.204.230.214]) [94.204.230.214]:45392: 535 Incorrect authentication data (set_id=efreeman@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.194.8
description:
Jan 27 02:28:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.194.8 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.87.10.83
description:
2025-01-27 02:29:03 dovecot_plain authenticator failed for ([197.87.10.83]) [197.87.10.83]:34825: 535 Incorrect authentication data (set_id=ads20b00324y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.194.8
description:
2025-01-27 02:29:00 dovecot_plain authenticator failed for ([183.247.194.8]) [183.247.194.8]:52923: 535 Incorrect authentication data (set_id=efreeman)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.87.10.83
description:
Jan 27 02:29:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.87.10.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Jan 27 02:29:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.16
description:
Jan 27 02:28:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.16
description:
2025-01-27 02:28:42 dovecot_login authenticator failed for ([175.202.82.16]) [175.202.82.16]:46966: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.108.95.66
description:
Jan 27 02:28:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.108.95.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-27 02:28:48 dovecot_plain authenticator failed for (alimilyl) [109.108.95.66]:57383: 535 Incorrect authentication data (set_id=eng20a00098y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-01-27 02:29:20 dovecot_login authenticator failed for ([183.196.174.235]) [183.196.174.235]:11641: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.169.117.118
description:
Jan 27 02:29:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.169.117.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.233.12.109
description:
Jan 27 02:30:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.233.12.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
description:
2025-01-27 02:30:14 dovecot_plain authenticator failed for ([80.233.12.109]) [80.233.12.109]:27938: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.46
description:
Jan 27 02:30:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.144.86
description:
2025-01-27 02:30:28 dovecot_login authenticator failed for 24-119-144-86.cpe.sparklight.net [24.119.144.86]:33716: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-27 02:29:34 dovecot_login authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:54376: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.228.40
description:
2025-01-27 02:29:47 dovecot_login authenticator failed for ([104.241.228.40]) [104.241.228.40]:57943: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.189
description:
2025-01-27 02:30:13 dovecot_login authenticator failed for ([111.61.177.189]) [111.61.177.189]:26944: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.46
description:
2025-01-27 02:30:22 dovecot_login authenticator failed for (hK7Nty1) [185.241.208.46]:53188: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 27 02:30:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.88.154.47
description:
Jan 27 02:30:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.88.154.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-27 02:30:25 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:37786: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.119.144.86
description:
Jan 27 02:30:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.119.144.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.228.40
description:
Jan 27 02:29:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.228.40 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 02:29:35 ait sshd[2598745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.141.211.58
description:
Jan 27 02:29:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.141.211.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.223.239.134
description:
Jan 27 02:30:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.223.239.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.154.47
description:
2025-01-27 02:30:26 dovecot_plain authenticator failed for (47.154.88.116.starhub.net.sg) [116.88.154.47]:41158: 535 Incorrect authentication data (set_id=ads20a00079y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 27 02:29:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.141.211.58
description:
2025-01-27 02:29:44 dovecot_plain authenticator failed for (200-141-211-58.host.telemar.net.br) [200.141.211.58]:48514: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.152.249
description:
2025-01-27 02:30:07 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.152.249]:45911: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.189
description:
Jan 27 02:30:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.239.134
description:
2025-01-27 02:30:23 dovecot_login authenticator failed for (134.239.223.60.adsl-pool.sx.cn) [60.223.239.134]:47253: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 02:29:35 ait sshd[2598745]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.241.208.46
description:
2025-01-27 02:30:51 dovecot_login authenticator failed for (ZNP6qJiSYs) [185.241.208.46]:60031: 535 Incorrect authentication data (set_id=obiri@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.164.96.154
description:
[2025-01-27 02:30:54 +0100] info [webmaild] 45.164.96.154 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.75.179.106
description:
Jan 27 02:31:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.75.179.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.76.91.165
description:
Jan 27 02:31:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.76.91.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.75.179.106
description:
2025-01-27 02:31:30 dovecot_login authenticator failed for ([222.75.179.106]) [222.75.179.106]:57815: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.122.139.172
description:
Jan 27 02:30:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.122.139.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.245.37
description:
2025-01-27 02:30:39 dovecot_login authenticator failed for 171-100-245-37.static.asianet.co.th [171.100.245.37]:33730: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.241.208.46
description:
Jan 27 02:30:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.241.208.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.212
description:
Jan 27 02:30:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.212
description:
2025-01-27 02:30:56 dovecot_login authenticator failed for ([195.178.110.212]) [195.178.110.212]:57736: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 02:31:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.122.139.172
description:
2025-01-27 02:30:35 dovecot_plain authenticator failed for syn-070-122-139-172.res.spectrum.com [70.122.139.172]:48509: 535 Incorrect authentication data (set_id=ads20a00079y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.100.245.37
description:
Jan 27 02:30:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.100.245.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.213.144
description:
2025-01-27 02:32:22 dovecot_login authenticator failed for ([211.105.213.144]) [211.105.213.144]:54094: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.76.91.165
description:
2025-01-27 02:31:31 dovecot_login authenticator failed for ([65.76.91.165]) [65.76.91.165]:34996: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-01-27 02:31:51 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:50528: 535 Incorrect authentication data (set_id=support@ait-open.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.93.172.213
description:
Jan 27 02:32:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.93.172.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.93.172.213
description:
2025-01-27 02:32:05 dovecot_login authenticator failed for (static.vinacis.com) [180.93.172.213]:38276: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.105.213.144
description:
Jan 27 02:32:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.105.213.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.46
description:
Jan 27 02:32:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.143.51.58
description:
Jan 27 02:31:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.143.51.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.230.122
description:
Jan 27 02:31:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.230.122 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 170.81.149.187
description:
[2025-01-27 02:31:48 +0100] info [webmaild] 170.81.149.187 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.143.51.58
description:
2025-01-27 02:31:39 dovecot_login authenticator failed for host81-143-51-58.in-addr.btopenworld.com [81.143.51.58]:47860: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.98.249.9
description:
2025-01-27 02:31:50 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:46693: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Jan 27 02:31:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.46
description:
2025-01-27 02:32:22 dovecot_login authenticator failed for ([91.73.195.46]) [91.73.195.46]:52781: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 51.210.117.52
domain: mail.iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:iric_admin||WPU:iric_admin||RSV:6.65||T:APACHE||MV:02-32.51.210.117.52


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.230.122
description:
2025-01-27 02:31:43 dovecot_login authenticator failed for ([67.213.230.122]) [67.213.230.122]:21363: 535 Incorrect authentication data (set_id=webmaster@aitonline.us)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.98.249.9
description:
Jan 27 02:31:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.98.249.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.222.56
description:
Jan 27 02:32:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.222.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.222.56
description:
2025-01-27 02:32:07 dovecot_login authenticator failed for ([178.178.222.56]) [178.178.222.56]:52024: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 144.48.49.72
description:
Jan 27 02:32:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 144.48.49.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.48.49.72
description:
2025-01-27 02:32:39 dovecot_login authenticator failed for ([144.48.49.72]) [144.48.49.72]:35024: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 02:33:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.246.112.254
description:
2025-01-27 02:33:22 dovecot_plain authenticator failed for nz112l254.bb60246.ctm.net [60.246.112.254]:59193: 535 Incorrect authentication data (set_id=abs21a00012y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.246.112.254
description:
Jan 27 02:33:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.246.112.254 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.136.42.222
description:
Jan 27 02:32:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.136.42.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.136.42.222
description:
2025-01-27 02:32:36 dovecot_login authenticator failed for (222-42-136-186.fibertel.com.ar) [186.136.42.222]:45892: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 27 02:34:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-27 02:34:25 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:30314: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.149.4.102
description:
Jan 27 02:33:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.149.4.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.149.4.102
description:
2025-01-27 02:33:41 dovecot_plain authenticator failed for ([200.149.4.102]) [200.149.4.102]:40368: 535 Incorrect authentication data (set_id=abs21a00012y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.37.230.47
description:
[2025-01-27 02:33:46 +0100] info [webmaild] 177.37.230.47 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.199.172.66
description:
Jan 27 02:34:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.199.172.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.199.172.66
description:
2025-01-27 02:34:39 dovecot_login authenticator failed for ([221.199.172.66]) [221.199.172.66]:47190: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
description:
2025-01-27 02:35:12 dovecot_login authenticator failed for ([121.142.146.167]) [121.142.146.167]:36395: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.120.186.246
description:
Jan 27 02:34:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.120.186.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.120.186.246
description:
2025-01-27 02:34:51 dovecot_plain authenticator failed for mail.schindler-statik.at (semend) [80.120.186.246]:59970: 535 Incorrect authentication data (set_id=rfiawoo13@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
description:
Jan 27 02:35:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.172.131
description:
Jan 27 02:35:21 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.172.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.172.131
description:
2025-01-27 02:35:23 dovecot_login authenticator failed for ([5.11.172.131]) [5.11.172.131]:36998: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.69.210.199
description:
Jan 27 02:36:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.69.210.199 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.69.210.199
description:
2025-01-27 02:36:12 dovecot_login authenticator failed for ([117.69.210.199]) [117.69.210.199]:56989: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 94.128.82.184
description:
[2025-01-27 02:35:38 +0100] info [webmaild] 94.128.82.184 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.224.198
description:
2025-01-27 02:35:42 dovecot_plain authenticator failed for (grunnist) [65.20.224.198]:49576: 535 Incorrect authentication data (set_id=tyeboah@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.76.202.22
description:
Jan 27 02:35:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.76.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.76.202.22
description:
2025-01-27 02:35:58 dovecot_login authenticator failed for ([218.76.202.22]) [218.76.202.22]:40780: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 02:37:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.208.108.52
description:
2025-01-27 02:37:13 dovecot_plain authenticator failed for ([60.208.108.52]) [60.208.108.52]:55614: 535 Incorrect authentication data (set_id=eng19b00204)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 96.1.34.28
description:
Jan 27 02:36:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 96.1.34.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.255.212.146
description:
2025-01-27 02:37:03 dovecot_plain authenticator failed for ([185.255.212.146]) [185.255.212.146]:8128: 535 Incorrect authentication data (set_id=eng19b00204@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.208.108.52
description:
Jan 27 02:37:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.208.108.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.97.108
description:
2025-01-27 02:37:24 dovecot_login authenticator failed for ([111.61.97.108]) [111.61.97.108]:44160: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.1.34.28
description:
2025-01-27 02:36:45 dovecot_login authenticator failed for 96-1-34-28-staticipeast.wireless.telus.com [96.1.34.28]:51218: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 101.224.33.197
description:
Jan 27 02:36:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 101.224.33.197 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.224.33.197
description:
2025-01-27 02:36:58 dovecot_login authenticator failed for ([183.193.94.254]) [101.224.33.197]:28990: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.146
description:
Jan 27 02:37:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 27 02:37:20 ait sshd[2601530]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 27 02:37:20 ait sshd[2601530]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.97.108
description:
Jan 27 02:37:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.97.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
description:
Jan 27 02:37:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.100
description:
2025-01-27 02:37:47 dovecot_login authenticator failed for (m121-202-152-100.smartone.com) [121.202.152.100]:64981: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.10.121.246
description:
2025-01-27 02:37:55 dovecot_plain authenticator failed for syn-098-010-121-246.res.spectrum.com (098-010-121-246.res.spectrum.com) [98.10.121.246]:39546: 535 Incorrect authentication data (set_id=ads88a00080y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.204.237.3
description:
2025-01-27 02:38:01 dovecot_plain authenticator failed for ([37.204.237.3]) [37.204.237.3]:45462: 535 Incorrect authentication data (set_id=jntsoumou@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.106.154.133
description:
2025-01-27 02:38:02 dovecot_login authenticator failed for ([103.106.154.133]) [103.106.154.133]:47822: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.203.9
description:
2025-01-27 02:38:16 dovecot_plain authenticator failed for ([121.188.203.9]) [121.188.203.9]:59033: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.227.99.162
description:
2025-01-27 02:37:36 dovecot_login authenticator failed for ([80.227.99.162]) [80.227.99.162]:41524: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.100
description:
Jan 27 02:37:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
description:
2025-01-27 02:37:47 dovecot_login authenticator failed for ([120.29.140.140]) [120.29.140.140]:42676: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.10.121.246
description:
Jan 27 02:37:53 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.10.121.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.86.209.86
description:
2025-01-27 02:37:57 dovecot_plain authenticator failed for ([106.86.209.86]) [106.86.209.86]:26884: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.134.78.162
description:
Jan 27 02:38:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.134.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.188.203.9
description:
Jan 27 02:38:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.188.203.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.129.94
description:
Jan 27 02:37:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.129.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.173.9.96
description:
2025-01-27 02:37:45 dovecot_plain authenticator failed for syn-104-173-009-096.res.spectrum.com (104-173-009-096.res.spectrum.com) [104.173.9.96]:50835: 535 Incorrect authentication data (set_id=ads88a00080y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.239.255.163
description:
2025-01-27 02:37:46 dovecot_plain authenticator failed for (supecte) [77.239.255.163]:46050: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.223.41.90
description:
Jan 27 02:37:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.223.41.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.86.209.86
description:
Jan 27 02:37:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.86.209.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.134.78.162
description:
2025-01-27 02:38:13 dovecot_plain authenticator failed for ([36.134.78.162]) [36.134.78.162]:52945: 535 Incorrect authentication data (set_id=jntsoumou)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.227.99.162
description:
Jan 27 02:37:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.227.99.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.129.94
description:
2025-01-27 02:37:40 dovecot_plain authenticator failed for host-41-220-129-94.habari.co.tz ([197.250.7.50]) [41.220.129.94]:59106: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.173.9.96
description:
Jan 27 02:37:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.173.9.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.239.255.163
description:
Jan 27 02:37:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.239.255.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.41.90
description:
2025-01-27 02:37:52 dovecot_plain authenticator failed for ([211.223.41.90]) [211.223.41.90]:37104: 535 Incorrect authentication data (set_id=awadzie)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.204.237.3
description:
Jan 27 02:37:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.204.237.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.106.154.133
description:
Jan 27 02:38:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.106.154.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 54.36.108.223
description:
Jan 27 02:39:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 54.36.108.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.211.77.58
description:
Jan 27 02:39:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.211.77.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.211.77.58
description:
2025-01-27 02:39:19 dovecot_login authenticator failed for (fa138.54.fix-addr.vsi.ru) [81.211.77.58]:30277: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.165.148.166
description:
2025-01-27 02:39:26 dovecot_plain authenticator failed for (148166.telemar.net.br) [200.165.148.166]:45117: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 02:38:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.152.120.40
description:
Jan 27 02:39:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.152.120.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.152.120.40
description:
2025-01-27 02:39:05 dovecot_plain authenticator failed for ([39.152.120.40]) [39.152.120.40]:22974: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.129.6.100
description:
2025-01-27 02:39:47 dovecot_plain authenticator failed for (100.6.129.180.unknown.m1.com.sg) [180.129.6.100]:46502: 535 Incorrect authentication data (set_id=ads21b00277y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.158
description:
2025-01-27 02:40:00 dovecot_login authenticator failed for ([104.241.230.158]) [104.241.230.158]:59021: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.69.17.18
description:
2025-01-27 02:40:06 dovecot_plain authenticator failed for (70.246.50.116.ids.service.static.eastern-tele.com) [58.69.17.18]:53074: 535 Incorrect authentication data (set_id=assdas3)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.20.22.58
description:
2025-01-27 02:39:41 dovecot_plain authenticator failed for (8-20-22-58.hwccustomers.com) [8.20.22.58]:57527: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.84.122.203
description:
2025-01-27 02:39:47 dovecot_login authenticator failed for (ppp-82-84-122-203.dialup.tiscali.it) [82.84.122.203]:62396: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.165.23
description:
2025-01-27 02:39:58 dovecot_plain authenticator failed for ([45.118.165.23]) [45.118.165.23]:33829: 535 Incorrect authentication data (set_id=ads21b00277y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.209
description:
Jan 27 02:39:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.143.30.155
description:
2025-01-27 02:39:54 dovecot_plain authenticator failed for ([222.143.30.155]) [222.143.30.155]:32952: 535 Incorrect authentication data (set_id=afenyo@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.84.122.203
description:
Jan 27 02:39:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.84.122.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.215.232
description:
Jan 27 02:39:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.215.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.215.232
description:
2025-01-27 02:39:51 dovecot_login authenticator failed for (232.215.221.60.adsl-pool.sx.cn) [60.221.215.232]:53511: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 132.255.181.205
description:
[2025-01-27 02:39:55 +0100] info [webmaild] 132.255.181.205 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.91.178.253
description:
2025-01-27 02:40:31 dovecot_login authenticator failed for ([111.91.178.253]) [111.91.178.253]:43734: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.249.207.53
description:
2025-01-27 02:39:32 dovecot_plain authenticator failed for 60-249-207-53.hinet-ip.hinet.net [60.249.207.53]:58659: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.151.86.9
description:
Jan 27 02:39:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.151.86.9 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 02:39:50 ait sshd[2602689]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.252.209.189
description:
Jan 27 02:40:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.252.209.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.151.86.9
description:
2025-01-27 02:39:45 dovecot_login authenticator failed for ([211.151.86.9]) [211.151.86.9]:44898: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.64
description:
2025-01-27 02:39:50 dovecot_login authenticator failed for ([92.118.39.64]) [92.118.39.64]:55853: 535 Incorrect authentication data (set_id=helpdesk)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.230.245.72
description:
Jan 27 02:39:31 ait sshd[2602500]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.245.72  user=root


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 02:39:50 ait sshd[2602689]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.230.158
description:
Jan 27 02:39:58 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.230.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.252.209.189
description:
2025-01-27 02:40:10 dovecot_plain authenticator failed for ([195.252.209.189]) [195.252.209.189]:56649: 535 Incorrect authentication data (set_id=afenyo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.48.60.35
description:
Jan 27 02:40:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.48.60.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 8.20.22.58
description:
Jan 27 02:39:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 8.20.22.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
description:
2025-01-27 02:39:56 dovecot_plain authenticator failed for ([41.224.62.206]) [41.224.62.206]:45570: 535 Incorrect authentication data (set_id=assdas3@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.64
description:
Jan 27 02:39:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.69.17.18
description:
Jan 27 02:40:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.69.17.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.91.178.253
description:
Jan 27 02:40:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.91.178.253 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.209
description:
2025-01-27 02:39:45 dovecot_login authenticator failed for ([195.178.110.209]) [195.178.110.209]:54574: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.78.11.10
description:
2025-01-27 02:40:06 dovecot_login authenticator failed for ([112.78.11.10]) [112.78.11.10]:32940: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.60.35
description:
2025-01-27 02:40:31 dovecot_login authenticator failed for ([211.48.60.35]) [211.48.60.35]:53886: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.230.245.72
description:
Jan 27 02:39:31 ait sshd[2602500]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.230.245.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.165.23
description:
Jan 27 02:39:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.165.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.220.168.116
description:
Jan 27 02:41:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.220.168.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.220.168.116
description:
2025-01-27 02:41:27 dovecot_login authenticator failed for (31-220-168-116.rdtc.ru) [31.220.168.116]:33537: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 02:41:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.206.24.234
description:
Jan 27 02:40:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.206.24.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.71.214.155
description:
2025-01-27 02:40:47 dovecot_login authenticator failed for wsip-174-71-214-155.lv.lv.cox.net [174.71.214.155]:52464: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.234
description:
2025-01-27 02:40:47 dovecot_login authenticator failed for ([223.26.225.129]) [210.206.24.234]:21641: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.183.11.30
description:
2025-01-27 02:42:20 dovecot_login authenticator failed for ([103.183.11.30]) [103.183.11.30]:36084: 535 Incorrect authentication data (set_id=info@elmisa.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.151.51.223
description:
2025-01-27 02:42:27 dovecot_login authenticator failed for customer-ip-193-151-51-223.ipv.net.pl [193.151.51.223]:55952: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-27 02:42:04 dovecot_plain authenticator failed for (aglaeres) [147.235.97.158]:30383: 535 Incorrect authentication data (set_id=tsikpo@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
description:
2025-01-27 02:42:11 dovecot_login authenticator failed for ([119.195.77.177]) [119.195.77.177]:37401: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.243.79.22
description:
2025-01-27 02:41:41 dovecot_login authenticator failed for 191-243-79-22.telecomconectividade.net.br [191.243.79.22]:38169: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.178.39.106
description:
2025-01-27 02:41:51 dovecot_login authenticator failed for ([220.178.39.106]) [220.178.39.106]:54066: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.217
description:
2025-01-27 02:41:53 dovecot_login authenticator failed for ([195.178.110.217]) [195.178.110.217]:52897: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.217
description:
Jan 27 02:41:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.230.245.72
description:
Jan 27 02:41:58 ait sshd[2603502]: pam_imunify(sshd:auth): [IM360_RBL] The IP 157.230.245.72 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 157.230.245.72
description:
Jan 27 02:41:58 ait sshd[2603502]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=157.230.245.72  user=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.167.55.230
description:
2025-01-27 02:41:58 dovecot_login authenticator failed for ([168.167.55.230]) [168.167.55.230]:57032: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.51.214.170
description:
Jan 27 02:41:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.51.214.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.51.214.170
description:
2025-01-27 02:41:38 dovecot_login authenticator failed for (pppoe-static.mosoblast.rt.ru) [77.51.214.170]:60093: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.243.79.22
description:
Jan 27 02:41:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.243.79.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 27 02:42:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.178.110.214
description:
Jan 27 02:42:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.178.110.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.178.110.214
description:
2025-01-27 02:42:17 dovecot_login authenticator failed for ([195.178.110.214]) [195.178.110.214]:63833: 535 Incorrect authentication data (set_id=scan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.151.51.223
description:
Jan 27 02:42:25 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.151.51.223 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.198
description:
Jan 27 02:41:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.198
description:
2025-01-27 02:41:41 dovecot_login authenticator failed for ([111.61.176.198]) [111.61.176.198]:50994: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.178.39.106
description:
Jan 27 02:41:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.178.39.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-01-27 02:42:51 dovecot_plain authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:31453: 535 Incorrect authentication data (set_id=eng18b00179y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.16.21.118
description:
Jan 27 02:43:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.16.21.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 27 02:43:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.235.126
description:
Jan 27 02:42:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.235.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.235.126
description:
2025-01-27 02:42:33 dovecot_plain authenticator failed for ([220.189.235.126]) [220.189.235.126]:35961: 535 Incorrect authentication data (set_id=eng18b00179y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Jan 27 02:42:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.108.95.66
description:
2025-01-27 02:43:21 dovecot_plain authenticator failed for (caspent) [109.108.95.66]:41584: 535 Incorrect authentication data (set_id=ads17b00151y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.173.114.254
description:
2025-01-27 02:43:22 dovecot_plain authenticator failed for ([60.173.114.254]) [60.173.114.254]:51058: 535 Incorrect authentication data (set_id=eng22a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.220.167.38
description:
2025-01-27 02:43:04 dovecot_login authenticator failed for ([223.220.167.38]) [223.220.167.38]:53528: 535 Incorrect authentication data (set_id=onajah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.167.20.116
description:
2025-01-27 02:43:05 dovecot_login authenticator failed for (116.20.167.124.adsl-pool.sx.cn) [124.167.20.116]:45019: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.27.234.178
description:
2025-01-27 02:43:11 dovecot_plain authenticator failed for ([71.27.234.178]) [71.27.234.178]:36312: 535 Incorrect authentication data (set_id=eng22a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-27 02:43:16 dovecot_login authenticator failed for ([20.46.45.121]) [20.46.45.121]:62984: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.167.20.116
description:
Jan 27 02:43:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.167.20.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.16.21.118
description:
2025-01-27 02:43:13 dovecot_login authenticator failed for (5x16x21x118.static-business.spb.ertelecom.ru) [5.16.21.118]:55674: 535 Incorrect authentication data (set_id=onajah)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.173.114.254
description:
Jan 27 02:43:20 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.173.114.254 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.208.99.163
description:
2025-01-27 02:44:14 dovecot_plain authenticator failed for ([82.208.99.163]) [82.208.99.163]:55470: 535 Incorrect authentication data (set_id=eharry@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.106.196.150
description:
Jan 27 02:44:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.106.196.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
description:
2025-01-27 02:43:46 dovecot_login authenticator failed for ([60.172.230.184]) [60.172.230.184]:57973: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.37.225.169
description:
Jan 27 02:43:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.37.225.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.37.225.169
description:
2025-01-27 02:43:53 dovecot_login authenticator failed for net-2-37-225-169.cust.vodafonedsl.it [2.37.225.169]:40268: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.247.11.122
description:
[2025-01-27 02:44:10 +0100] info [webmaild] 186.247.11.122 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 187.87.21.234
description:
[2025-01-27 02:44:12 +0100] info [webmaild] 187.87.21.234 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.106.196.150
description:
2025-01-27 02:44:29 dovecot_plain authenticator failed for ([128.106.196.150]) [128.106.196.150]:15979: 535 Incorrect authentication data (set_id=eharry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.230.93
description:
2025-01-27 02:43:33 dovecot_login authenticator failed for ([104.241.230.93]) [104.241.230.93]:46921: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
description:
Jan 27 02:43:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.208.99.163
description:
Jan 27 02:44:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.208.99.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.123.172.7
description:
Jan 27 02:45:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.123.172.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.162.74.47
description:
2025-01-27 02:45:08 dovecot_login authenticator failed for 46-162-74-47.cust.bredband2.com [46.162.74.47]:57310: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.98.208.115
description:
2025-01-27 02:45:25 dovecot_login authenticator failed for (host-115-208-static-98-201.uninet-ide.com.mx) [201.98.208.115]:49496: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.2.141.155
description:
Jan 27 02:44:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.2.141.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 42.119.180.238
description:
Jan 27 02:44:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 42.119.180.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 42.119.180.238
description:
2025-01-27 02:44:58 dovecot_login authenticator failed for ([42.119.180.238]) [42.119.180.238]:48743: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.162.74.47
description:
Jan 27 02:45:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.162.74.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.125.14.122
description:
2025-01-27 02:44:34 dovecot_login authenticator failed for (r200-125-14-122.ae-static.anteldata.net.uy) [200.125.14.122]:34570: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.2.141.155
description:
2025-01-27 02:44:36 dovecot_login authenticator failed for ([59.2.141.155]) [59.2.141.155]:44804: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.98.208.115
description:
Jan 27 02:45:23 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.98.208.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.197.86
description:
2025-01-27 02:45:45 dovecot_plain authenticator failed for ([121.202.197.86]) [121.202.197.86]:64956: 535 Incorrect authentication data (set_id=assdas4)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.175.39.76
description:
2025-01-27 02:45:46 dovecot_plain authenticator failed for ([111.175.39.76]) [111.175.39.76]:39097: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.158.72.138
description:
2025-01-27 02:45:41 dovecot_plain authenticator failed for 67-158-72-138.dhcp.execulink.com [67.158.72.138]:38416: 535 Incorrect authentication data (set_id=mumuni)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.158.72.138
description:
Jan 27 02:45:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.158.72.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 177.191.173.238
description:
[2025-01-27 02:46:01 +0100] info [webmaild] 177.191.173.238 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.215.254.115
description:
2025-01-27 02:46:17 dovecot_plain authenticator failed for 217-215-254-115-no2460.tbcn.telia.com (lacry) [217.215.254.115]:59328: 535 Incorrect authentication data (set_id=abs32a11154y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.165.126.166
description:
[2025-01-27 02:46:26 +0100] info [webmaild] 179.165.126.166 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 27 02:45:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.240.2.38
description:
2025-01-27 02:45:31 dovecot_plain authenticator failed for ([58.240.2.38]) [58.240.2.38]:58608: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-27 02:45:36 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:59026: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.240.2.38
description:
Jan 27 02:45:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.240.2.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.197.86
description:
Jan 27 02:45:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.197.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.175.39.76
description:
Jan 27 02:45:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.175.39.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.196.84.188
description:
Jan 27 02:45:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.196.84.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.196.84.188
description:
2025-01-27 02:45:57 dovecot_plain authenticator failed for static-168-196-84-188.hilink.net.br [168.196.84.188]:48701: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.120.163.110
description:
2025-01-27 02:45:34 dovecot_plain authenticator failed for ([212.120.163.110]) [212.120.163.110]:59290: 535 Incorrect authentication data (set_id=assdas4@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.176.252.225
description:
2025-01-27 02:46:39 dovecot_login authenticator failed for syn-076-176-252-225.res.spectrum.com [76.176.252.225]:60416: 535 Incorrect authentication data (set_id=igonuotxre@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.126.223.175
description:
2025-01-27 02:46:47 dovecot_login authenticator failed for ([92.126.223.175]) [92.126.223.175]:60160: 535 Incorrect authentication data (set_id=igonuotxre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.44
description:
2025-01-27 02:47:07 dovecot_plain authenticator failed for 110-25-107-44.adsl.fetnet.net [110.25.107.44]:35735: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.65.133.62
description:
[2025-01-27 02:47:11 +0100] info [webmaild] 45.65.133.62 - info@tit-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.234.140.28
description:
2025-01-27 02:47:11 dovecot_plain authenticator failed for ([100.64.100.6]) [104.234.140.28]:47636: 535 Incorrect authentication data (set_id=eng22b00146y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.32.14
description:
2025-01-27 02:47:17 dovecot_login authenticator failed for ([5.32.32.14]) [5.32.32.14]:48277: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.123.220
description:
Jan 27 02:47:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.123.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.229
description:
Jan 27 02:47:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.229
description:
2025-01-27 02:47:26 dovecot_login authenticator failed for (m121-202-153-229.smartone.com) [121.202.153.229]:26490: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.126.223.175
description:
Jan 27 02:46:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.126.223.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.228.225.20
description:
2025-01-27 02:47:06 dovecot_login authenticator failed for ([122.228.225.20]) [122.228.225.20]:36578: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.123.220
description:
2025-01-27 02:47:20 dovecot_login authenticator failed for syn-173-095-123-220.biz.spectrum.com [173.95.123.220]:37494: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.40.100.158
description:
2025-01-27 02:47:12 dovecot_plain authenticator failed for ([27.40.100.158]) [27.40.100.158]:48077: 535 Incorrect authentication data (set_id=ads20a00254y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.32.14
description:
Jan 27 02:47:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.32.14 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 186.53.3.209
description:
[2025-01-27 02:47:16 +0100] info [webmaild] 186.53.3.209 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.176.252.225
description:
Jan 27 02:46:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.176.252.225 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.40.100.158
description:
Jan 27 02:47:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.40.100.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.101
description:
2025-01-27 02:48:08 dovecot_login authenticator failed for st7013.mas4401.y-tokyo.nttpc.ne.jp [160.248.75.101]:49810: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 38.156.229.180
description:
[2025-01-27 02:48:04 +0100] info [webmaild] 38.156.229.180 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 160.248.75.101
description:
Jan 27 02:48:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 160.248.75.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.180.84.109
description:
Jan 27 02:48:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.180.84.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.235.97.158
description:
Jan 27 02:47:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.235.97.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.160.123.6
description:
2025-01-27 02:48:03 dovecot_plain authenticator failed for (matinalite) [109.160.123.6]:42652: 535 Incorrect authentication data (set_id=mumuni@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.246.214
description:
Jan 27 02:48:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.246.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.246.214
description:
2025-01-27 02:48:10 dovecot_plain authenticator failed for (nsg-corporate-214.246.187.122.airtel.in) [122.187.246.214]:49159: 535 Incorrect authentication data (set_id=ads20b00337y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.48.151.136
description:
2025-01-27 02:48:22 dovecot_login authenticator failed for 136.151.48.116.static.netvigator.com [116.48.151.136]:53048: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-27 02:48:28 dovecot_plain authenticator failed for ([103.107.36.18]) [103.107.36.18]:41500: 535 Incorrect authentication data (set_id=dgyan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.236.111.18
description:
2025-01-27 02:48:28 dovecot_plain authenticator failed for ([156.236.111.18]) [156.236.111.18]:33336: 535 Incorrect authentication data (set_id=tgbadamosi@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.81.213.46
description:
2025-01-27 02:48:29 dovecot_login authenticator failed for ([203.81.213.46]) [203.81.213.46]:54081: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
description:
2025-01-27 02:47:33 dovecot_login authenticator failed for ([218.106.120.18]) [58.49.113.138]:19704: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.48.194.21
description:
Jan 27 02:47:34 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.48.194.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.135.125.196
description:
2025-01-27 02:47:59 dovecot_plain authenticator failed for ([36.135.125.196]) [36.135.125.196]:50430: 535 Incorrect authentication data (set_id=ads20b00337y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.236.111.18
description:
Jan 27 02:48:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.236.111.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
description:
Jan 27 02:47:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 201.191.198.2
description:
[2025-01-27 02:47:53 +0100] info [webmaild] 201.191.198.2 - info@aitvarsity.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.135.125.196
description:
Jan 27 02:47:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.135.125.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.180.84.109
description:
2025-01-27 02:48:17 dovecot_plain authenticator failed for (abts-north-static-109.84.180.122.airtelbroadband.in) [122.180.84.109]:48458: 535 Incorrect authentication data (set_id=dgyan@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.81.213.46
description:
Jan 27 02:48:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.81.213.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 02:48:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.48.194.21
description:
2025-01-27 02:47:36 dovecot_plain authenticator failed for ([103.48.194.21]) [103.48.194.21]:39228: 535 Incorrect authentication data (set_id=ads20a00254y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.235.97.158
description:
2025-01-27 02:47:36 dovecot_login authenticator failed for ([147.235.97.158]) [147.235.97.158]:30403: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 27 02:48:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.118.123
description:
2025-01-27 02:48:35 dovecot_plain authenticator failed for ([60.174.118.123]) [60.174.118.123]:51954: 535 Incorrect authentication data (set_id=ads20a00173y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.119.118
description:
2025-01-27 02:48:42 dovecot_plain authenticator failed for 118-119-237-24.gci.net [24.237.119.118]:52334: 535 Incorrect authentication data (set_id=ads21b00230y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.100.107.238
description:
Jan 27 02:48:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.100.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.221.224.220
description:
Jan 27 02:48:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.221.224.220 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 02:48:52 ait sshd[2606055]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.140.244.144
description:
Jan 27 02:49:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.140.244.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.140.244.144
description:
2025-01-27 02:49:21 dovecot_login authenticator failed for ([125.140.244.144]) [125.140.244.144]:58612: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.237.119.118
description:
Jan 27 02:48:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.237.119.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.221.224.220
description:
2025-01-27 02:48:42 dovecot_plain authenticator failed for (220.224.221.60.adsl-pool.sx.cn) [60.221.224.220]:34750: 535 Incorrect authentication data (set_id=tgbadamosi)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 02:48:52 ait sshd[2606055]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.100.107.238
description:
2025-01-27 02:48:52 dovecot_plain authenticator failed for (dynamic-ip-adsl.metfone.com.kh) [175.100.107.238]:34988: 535 Incorrect authentication data (set_id=ads20a00173y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.223.203
description:
2025-01-27 02:48:54 dovecot_plain authenticator failed for ([210.99.223.203]) [210.99.223.203]:59906: 535 Incorrect authentication data (set_id=ads21b00230y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.29.196.170
description:
Jan 27 02:49:08 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.29.196.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.99.223.203
description:
Jan 27 02:48:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.99.223.203 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.29.196.170
description:
2025-01-27 02:49:10 dovecot_plain authenticator failed for ([71.29.196.170]) [71.29.196.170]:46570: 535 Incorrect authentication data (set_id=ads23a00076y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.103.35.130
description:
2025-01-27 02:49:17 dovecot_login authenticator failed for (host-130-35-103-103.xlinkbd.net) [103.103.35.130]:49449: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.15.84.229
description:
2025-01-27 02:49:21 dovecot_login authenticator failed for ([112.15.84.229]) [112.15.84.229]:64094: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.92.248
description:
2025-01-27 02:50:07 dovecot_login authenticator failed for ([106.51.92.248]) [106.51.92.248]:47414: 535 Incorrect authentication data (set_id=mssept2014)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.166.207.76
description:
2025-01-27 02:49:49 dovecot_plain authenticator failed for wsip-70-166-207-76.ph.ph.cox.net [70.166.207.76]:41798: 535 Incorrect authentication data (set_id=eng17b00238y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.51.92.248
description:
Jan 27 02:50:05 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.51.92.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.93.177.228
description:
Jan 27 02:49:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.93.177.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 70.166.207.76
description:
Jan 27 02:49:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 70.166.207.76 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.93.177.228
description:
2025-01-27 02:49:44 dovecot_plain authenticator failed for ([111.93.177.228]) [111.93.177.228]:55116: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.153.126
description:
2025-01-27 02:49:58 dovecot_login authenticator failed for (m121-202-153-126.smartone.com) [121.202.153.126]:31907: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.85.251.188
description:
2025-01-27 02:50:29 dovecot_login authenticator failed for ([115.85.251.188]) [115.85.251.188]:52744: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.152.221
description:
2025-01-27 02:49:37 dovecot_login authenticator failed for (m121-202-152-221.smartone.com) [121.202.152.221]:31049: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.242
description:
Jan 27 02:49:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.129.114.190
description:
Jan 27 02:49:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.129.114.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.49.40.138
description:
Jan 27 02:50:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.49.40.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 32.216.176.90
description:
Jan 27 02:50:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 32.216.176.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.196.174.235
description:
Jan 27 02:49:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.196.174.235 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.196.174.235
description:
2025-01-27 02:49:33 dovecot_plain authenticator failed for ([183.196.174.235]) [183.196.174.235]:46882: 535 Incorrect authentication data (set_id=ads23a00076y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.165.236.12
description:
Jan 27 02:49:42 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.165.236.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.92.208.12
description:
2025-01-27 02:50:15 dovecot_plain authenticator failed for ([116.92.208.12]) [116.92.208.12]:50186: 535 Incorrect authentication data (set_id=eng20b00229y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.207
description:
2025-01-27 02:49:55 dovecot_plain authenticator failed for ([167.250.119.207]) [167.250.119.207]:60684: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.153.126
description:
Jan 27 02:49:56 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.153.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.129.114.190
description:
2025-01-27 02:49:58 dovecot_login authenticator failed for ([185.129.114.190]) [185.129.114.190]:36534: 535 Incorrect authentication data (set_id=mssept2014@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.108.126.227
description:
Jan 27 02:50:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.108.126.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.108.126.227
description:
2025-01-27 02:50:04 dovecot_plain authenticator failed for ([114.108.126.227]) [114.108.126.227]:46104: 535 Incorrect authentication data (set_id=eng17b00238y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 115.85.251.188
description:
Jan 27 02:50:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 115.85.251.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.152.221
description:
Jan 27 02:49:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.152.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.92.208.12
description:
Jan 27 02:50:13 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.92.208.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.215.87.163
description:
Jan 27 02:50:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.215.87.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.215.87.163
description:
2025-01-27 02:50:16 dovecot_login authenticator failed for ([221.215.87.163]) [221.215.87.163]:34138: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.42.132.19
description:
Jan 27 02:50:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.42.132.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.242
description:
2025-01-27 02:49:43 dovecot_login authenticator failed for ([116.114.84.242]) [116.114.84.242]:52880: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.165.236.12
description:
2025-01-27 02:49:44 dovecot_login authenticator failed for ([39.165.236.12]) [39.165.236.12]:47240: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.182.17.122
description:
2025-01-27 02:50:45 dovecot_login authenticator failed for ([220.182.17.122]) [220.182.17.122]:47146: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.70.158.32
description:
Jan 27 02:51:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.70.158.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.29.135.230
description:
2025-01-27 02:51:16 dovecot_login authenticator failed for 50.29.135.230.res-cmts.mtp2.ptd.net [50.29.135.230]:36104: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.74.225.186
description:
Jan 27 02:51:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.74.225.186 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.42.132.19
description:
2025-01-27 02:50:30 dovecot_login authenticator failed for ([111.42.132.19]) [111.42.132.19]:45736: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.189.118.24
description:
2025-01-27 02:51:21 dovecot_plain authenticator failed for (5.189.118.24-FTTB.planeta.tc) [5.189.118.24]:47586: 535 Incorrect authentication data (set_id=ads20b00296y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.74.225.186
description:
2025-01-27 02:51:26 dovecot_login authenticator failed for (dumy186.panafonet.gr) [62.74.225.186]:34447: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.46.26.98
description:
Jan 27 02:50:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.46.26.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.55.114.171
description:
Jan 27 02:51:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.55.114.171 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.201.20
description:
2025-01-27 02:51:19 dovecot_login authenticator failed for ([106.10.69.50]) [183.108.201.20]:46644: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.216.37.11
description:
Jan 27 02:51:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.216.37.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.57.111.99
description:
Jan 27 02:51:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.57.111.99 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 94.72.109.35
domain: afaccra.u3l.us
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:02-51.94.72.109.35||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.118.39.63
description:
Jan 27 02:50:48 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.118.39.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.124.74
description:
Jan 27 02:50:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.124.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.132.150.162
description:
Jan 27 02:51:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.132.150.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.114.171
description:
2025-01-27 02:51:12 dovecot_plain authenticator failed for ([2.55.114.171]) [2.55.114.171]:52784: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.200.160.158
description:
2025-01-27 02:51:14 dovecot_plain authenticator failed for 158.160.200.177.netflexisp.com.br [177.200.160.158]:4496: 535 Incorrect authentication data (set_id=ads20b00296y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.189.118.24
description:
Jan 27 02:51:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.189.118.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.57.111.99
description:
2025-01-27 02:51:28 dovecot_plain authenticator failed for ([211.57.111.99]) [211.57.111.99]:38320: 535 Incorrect authentication data (set_id=ads19a00062y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.124.74
description:
2025-01-27 02:50:57 dovecot_plain authenticator failed for ([203.189.124.74]) [203.189.124.74]:33335: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.216.37.11
description:
2025-01-27 02:51:24 dovecot_plain authenticator failed for ([60.216.37.11]) [60.216.37.11]:38854: 535 Incorrect authentication data (set_id=ads19a00014y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.182.17.122
description:
Jan 27 02:50:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.182.17.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 32.216.176.90
description:
2025-01-27 02:50:30 dovecot_plain authenticator failed for 32-216-176-90.bng02.brpt.ct.frontiernet.net [32.216.176.90]:62802: 535 Incorrect authentication data (set_id=eng20b00229y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.46.26.98
description:
2025-01-27 02:50:42 dovecot_login authenticator failed for ([59.46.26.98]) [59.46.26.98]:44391: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.118.39.63
description:
2025-01-27 02:50:50 dovecot_login authenticator failed for ([92.118.39.63]) [92.118.39.63]:59362: 535 Incorrect authentication data (set_id=prueba)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.70.158.32
description:
2025-01-27 02:51:19 dovecot_plain authenticator failed for ([1.70.158.32]) [1.70.158.32]:39969: 535 Incorrect authentication data (set_id=mensah@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
description:
2025-01-27 02:50:54 dovecot_login authenticator failed for ([111.61.177.190]) [111.61.177.190]:59804: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.132.150.162
description:
2025-01-27 02:51:04 dovecot_login authenticator failed for 57-132-150-162.dyn.grandenetworks.net [57.132.150.162]:54822: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.200.160.158
description:
Jan 27 02:51:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.200.160.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.29.135.230
description:
Jan 27 02:51:14 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.29.135.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 146.190.50.206
description:
Jan 27 02:52:07 ait sshd[2607478]: pam_imunify(sshd:auth): [IM360_RBL] The IP 146.190.50.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.33.247.45
description:
2025-01-27 02:51:34 dovecot_plain authenticator failed for 92-33-247-45.customers.ownit.se (honist) [92.33.247.45]:36406: 535 Incorrect authentication data (set_id=abs22a00002y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.46.199.19
description:
Jan 27 02:51:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.46.199.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.202.82.251
description:
2025-01-27 02:51:51 dovecot_plain authenticator failed for ([175.202.82.251]) [175.202.82.251]:54902: 535 Incorrect authentication data (set_id=ads19a00014y)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 146.190.50.206
description:
Jan 27 02:52:07 ait sshd[2607478]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=146.190.50.206


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.202.82.251
description:
Jan 27 02:51:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.202.82.251 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 179.191.222.16
description:
[2025-01-27 02:52:07 +0100] info [webmaild] 179.191.222.16 - info@aitedu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.88.228.202
description:
Jan 27 02:51:41 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.88.228.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.199.19
description:
2025-01-27 02:51:43 dovecot_plain authenticator failed for (ppp19-lumwana.zamnet.zm) [196.46.199.19]:42798: 535 Incorrect authentication data (set_id=ads19a00062y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.33.247.45
description:
Jan 27 02:51:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.33.247.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.210.232
description:
2025-01-27 02:51:41 dovecot_plain authenticator failed for ([87.103.210.232]) [87.103.210.232]:38927: 535 Incorrect authentication data (set_id=mensah)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.88.228.202
description:
2025-01-27 02:51:43 dovecot_login authenticator failed for ([14.88.228.202]) [14.88.228.202]:51834: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.204.13
description:
2025-01-27 02:52:52 dovecot_plain authenticator failed for vps-45cb66f2.vps.ovh.net [135.125.204.13]:34294: 535 Incorrect authentication data (set_id=jpomador@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.248.232.70
description:
2025-01-27 02:52:59 dovecot_plain authenticator failed for (static-89-248-232-70.tel.ru) [89.248.232.70]:37706: 535 Incorrect authentication data (set_id=ads21b00206y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.142.230.50
description:
2025-01-27 02:53:20 dovecot_plain authenticator failed for ([123.142.230.50]) [123.142.230.50]:53482: 535 Incorrect authentication data (set_id=ads21b00206y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.65.1.179
description:
2025-01-27 02:52:34 dovecot_plain authenticator failed for ([49.65.1.179]) [49.65.1.179]:31313: 535 Incorrect authentication data (set_id=ads30b00480y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.210.98
description:
2025-01-27 02:53:24 dovecot_login authenticator failed for ([121.168.210.98]) [121.168.210.98]:23612: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.8.25.75
domain: ait.edu.gh
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:6.65||T:APACHE||MV:/wp-includes/images/about.php||SC:/home/ait02/public_html/wp-includes/images/about.php


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 135.125.204.13
description:
Jan 27 02:52:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 135.125.204.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.193.41.66
description:
2025-01-27 02:52:52 dovecot_plain authenticator failed for ([141.193.41.66]) [141.193.41.66]:58387: 535 Incorrect authentication data (set_id=ads30b00480y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.248.232.70
description:
Jan 27 02:52:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.248.232.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.235.76.1
description:
Jan 27 02:53:00 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.235.76.1 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.235.76.1
description:
2025-01-27 02:53:02 dovecot_plain authenticator failed for ([103.235.76.1]) [103.235.76.1]:38659: 535 Incorrect authentication data (set_id=jpomador)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
description:
Jan 27 02:53:19 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
description:
2025-01-27 02:53:21 dovecot_login authenticator failed for ([102.53.15.180]) [102.53.15.180]:49774: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 77.51.153.194
description:
[2025-01-27 02:53:25 +0100] info [webmaild] 77.51.153.194 - info@elibrary-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.210.98
description:
Jan 27 02:53:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.210.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 141.193.41.66
description:
Jan 27 02:52:50 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 141.193.41.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.142.230.50
description:
Jan 27 02:53:18 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.142.230.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.65.1.179
description:
Jan 27 02:52:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.65.1.179 has been locked due to Imunify RBL


plugin: modsec
rule: 77316861
name: IM360 WAF: Block IP which is in the infectors RBL
abuser: 45.8.25.59
domain: ait.edu.gh
description:
IM360 WAF: Block IP which is in the infectors RBL||MVN:TX:rbl_ip||MV:02-53.45.8.25.59||RSV:6.65||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
description:
Jan 27 02:54:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.49.182.103
description:
2025-01-27 02:53:49 dovecot_login authenticator failed for ([38.49.182.103]) [38.49.182.103]:35048: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.36.64.247
description:
Jan 27 02:53:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.36.64.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-27 02:54:18 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:58212: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.234.184
description:
Jan 27 02:53:31 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.234.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.234.184
description:
2025-01-27 02:53:33 dovecot_login authenticator failed for ([104.241.234.184]) [104.241.234.184]:53503: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.107.36.18
description:
Jan 27 02:53:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.107.36.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.49.182.103
description:
Jan 27 02:53:47 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.49.182.103 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.246.224.218
description:
Jan 27 02:53:59 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.246.224.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.10.20
description:
2025-01-27 02:54:08 dovecot_login authenticator failed for ([221.10.10.20]) [221.10.10.20]:56358: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
description:
2025-01-27 02:54:24 dovecot_login authenticator failed for ([112.194.142.167]) [112.194.142.167]:55396: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.33.171.65
description:
Jan 27 02:54:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.33.171.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.236.46
description:
Jan 27 02:54:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.236.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.253.90.113
description:
Jan 27 02:54:11 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.253.90.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.230.165.58
description:
Jan 27 02:54:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.230.165.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.107.36.18
description:
2025-01-27 02:53:35 dovecot_login authenticator failed for ([103.107.36.18]) [103.107.36.18]:48208: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 27 02:54:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.36.64.247
description:
2025-01-27 02:53:33 dovecot_login authenticator failed for net-2-36-64-247.cust.vodafonedsl.it [2.36.64.247]:37595: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.10.20
description:
Jan 27 02:54:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.10.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.236.46
description:
2025-01-27 02:54:08 dovecot_login authenticator failed for ([104.241.236.46]) [104.241.236.46]:56191: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
description:
2025-01-27 02:54:13 dovecot_plain authenticator failed for 89-253-90-113.customers.ownit.se [89.253.90.113]:58989: 535 Incorrect authentication data (set_id=ads09a99033y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.33.171.65
description:
2025-01-27 02:54:18 dovecot_login authenticator failed for sagitario.itmorelia.edu.mx [200.33.171.65]:64566: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.230.165.58
description:
2025-01-27 02:54:29 dovecot_plain authenticator failed for ([183.230.165.58]) [183.230.165.58]:36712: 535 Incorrect authentication data (set_id=ads09a99033y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 02:54:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.98.249.9
description:
Jan 27 02:54:36 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.98.249.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
description:
Jan 27 02:54:37 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.98.249.9
description:
2025-01-27 02:54:38 dovecot_login authenticator failed for ([27.98.249.9]) [27.98.249.9]:45445: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
description:
2025-01-27 02:54:39 dovecot_login authenticator failed for ([111.61.176.245]) [111.61.176.245]:65026: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 20.46.45.121
description:
Jan 27 02:56:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 20.46.45.121 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
description:
2025-01-27 02:56:17 dovecot_plain authenticator failed for ([20.46.45.121]) [20.46.45.121]:59787: 535 Incorrect authentication data (set_id=ads20a00243y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.174.3.182
description:
Jan 27 02:56:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.174.3.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.148.10.196
description:
Jan 27 02:56:24 ait sshd[2609154]: pam_imunify(sshd:auth): [IM360_RBL] The IP 45.148.10.196 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 45.148.10.196
description:
Jan 27 02:56:24 ait sshd[2609154]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.148.10.196


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.168.116.150
description:
Jan 27 02:55:32 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.168.116.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.168.116.150
description:
2025-01-27 02:55:34 dovecot_login authenticator failed for ([121.168.116.150]) [121.168.116.150]:64713: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.78
description:
2025-01-27 02:55:57 dovecot_login authenticator failed for (static.vnpt.vn) [113.160.140.78]:33486: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL block
abuser: 65.0.27.59
domain: iric.us
description:
IM360 WAF: WordPress Bruteforce RBL block||Name:admin||WPU:admin||RSV:6.65||T:APACHE||MV:02-56.65.0.27.59


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 81.16.170.117
description:
Jan 27 02:56:04 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 81.16.170.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.32.137.250
description:
Jan 27 02:55:44 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.32.137.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.247.127.250
description:
Jan 27 02:56:24 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.247.127.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.247.127.250
description:
2025-01-27 02:56:26 dovecot_plain authenticator failed for ([211.247.127.250]) [211.247.127.250]:43202: 535 Incorrect authentication data (set_id=ads21a00061y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.16.170.117
description:
2025-01-27 02:56:06 dovecot_login authenticator failed for ip117.net-81-16-170.koping.net [81.16.170.117]:37410: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.27.129.78
description:
Jan 27 02:56:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.27.129.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.27.129.78
description:
2025-01-27 02:56:08 dovecot_login authenticator failed for ([112.27.129.78]) [112.27.129.78]:52571: 535 Incorrect authentication data (set_id=asa@elmisa.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
description:
Jan 27 02:56:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.22.187.66
description:
2025-01-27 02:56:18 dovecot_login authenticator failed for ([218.22.187.68]) [218.22.187.66]:55114: 535 Incorrect authentication data (set_id=asa)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.32.137.250
description:
2025-01-27 02:55:46 dovecot_login authenticator failed for net-2-32-137-250.cust.dsl.teletu.it [2.32.137.250]:41298: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 113.160.140.78
description:
Jan 27 02:55:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 113.160.140.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.174.3.182
description:
2025-01-27 02:56:24 dovecot_plain authenticator failed for 182.3.174.178.static.wline.lns.sme.cust.swisscom.ch [178.174.3.182]:58724: 535 Incorrect authentication data (set_id=ads20a00243y)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 103.120.203.109
description:
[2025-01-27 02:56:32 +0100] info [webmaild] 103.120.203.109 - info@myait.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.117.32.22
description:
Jan 27 02:56:38 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.117.32.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.117.32.22
description:
2025-01-27 02:56:40 dovecot_plain authenticator failed for ([87.117.32.22]) [87.117.32.22]:54808: 535 Incorrect authentication data (set_id=ads21a00061y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.36.155.116
description:
Jan 27 02:57:03 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.36.155.116 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.202.149.117
description:
2025-01-27 02:57:17 dovecot_plain authenticator failed for ([120.202.149.117]) [120.202.149.117]:52124: 535 Incorrect authentication data (set_id=eng20b00166y)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.241.229.84
description:
Jan 27 02:57:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.241.229.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.36.155.116
description:
2025-01-27 02:57:05 dovecot_plain authenticator failed for (vipturbo.com.br) [191.36.155.116]:34061: 535 Incorrect authentication data (set_id=eng20b00166y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 185.187.78.29
description:
[2025-01-27 02:57:12 +0100] info [webmaild] 185.187.78.29 - info@lemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.202.149.117
description:
Jan 27 02:57:15 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.202.149.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.30.20.98
description:
Jan 27 02:57:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.30.20.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.8.50.150
description:
Jan 27 02:57:57 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.8.50.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.255.45
description:
Jan 27 02:58:12 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.255.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.241.229.84
description:
2025-01-27 02:57:31 dovecot_login authenticator failed for ([104.241.229.84]) [104.241.229.84]:58545: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.8.50.150
description:
2025-01-27 02:57:59 dovecot_plain authenticator failed for ([60.8.50.150]) [60.8.50.150]:47368: 535 Incorrect authentication data (set_id=ads20a00250y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.255.45
description:
2025-01-27 02:58:14 dovecot_plain authenticator failed for (27-123-255-45-mcnbd.com) [27.123.255.45]:59459: 535 Incorrect authentication data (set_id=ads20a00250y)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.30.20.98
description:
2025-01-27 02:57:47 dovecot_login authenticator failed for ([1.30.20.98]) [1.30.20.98]:53714: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 168.205.101.35
description:
[2025-01-27 02:58:52 +0100] info [webmaild] 168.205.101.35 - info@ait-edu.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.255.190.69
description:
Jan 27 02:59:29 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.255.190.69 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.88.252.16
description:
2025-01-27 02:59:47 dovecot_plain authenticator failed for ([39.88.252.16]) [39.88.252.16]:51686: 535 Incorrect authentication data (set_id=ddessel)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 03:00:03 ait sshd[2610678]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.180.118.166
description:
Jan 27 03:00:03 ait sshd[2610678]: Invalid user universitypublishing from 210.180.118.166 port 56800


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 27 03:00:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-27 03:00:12 dovecot_plain authenticator failed for (imetip) [93.159.152.6]:59598: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.13.237.76
description:
2025-01-27 03:00:19 dovecot_login authenticator failed for (hn.kd.ny.adsl) [123.13.237.76]:40790: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.255.190.69
description:
2025-01-27 02:59:31 dovecot_plain authenticator failed for ([92.255.190.69]) [92.255.190.69]:49460: 535 Incorrect authentication data (set_id=ddessel@ait-open.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.186.131.108
description:
2025-01-27 02:59:37 dovecot_login authenticator failed for ([121.186.131.108]) [121.186.131.108]:42376: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.116.42.218
description:
Jan 27 02:59:46 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.116.42.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.63
description:
Jan 27 03:00:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.63 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.222.67.60
description:
[2025-01-27 02:59:42 +0100] info [webmaild] 181.222.67.60 - info@jabmar.org "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.88.252.16
description:
Jan 27 02:59:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.88.252.16 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 03:00:03 ait sshd[2610678]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.63
description:
2025-01-27 03:00:08 dovecot_plain authenticator failed for (gruelis) [65.20.250.63]:41073: 535 Incorrect authentication data (set_id=ads20b00370y@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.13.237.76
description:
Jan 27 03:00:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.13.237.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.186.131.108
description:
Jan 27 02:59:35 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.186.131.108 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.116.42.218
description:
2025-01-27 02:59:48 dovecot_login authenticator failed for (218.91-116-42.dynamic.clientes.euskaltel.es) [91.116.42.218]:43586: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.170.10
description:
2025-01-27 03:00:41 dovecot_login authenticator failed for ([218.150.170.10]) [218.150.170.10]:57594: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.64.231.231
description:
Jan 27 03:00:34 ait sshd[2611676]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.64.231.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.150.170.10
description:
Jan 27 03:00:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.150.170.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.125.94.195
description:
Jan 27 03:01:57 ait sshd[2612234]: pam_imunify(sshd:auth): [IM360_RBL] The IP 175.125.94.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.126.123.231
description:
Jan 27 03:02:09 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.126.123.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.113.51.55
description:
Jan 27 03:02:26 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.113.51.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 03:01:43 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.94.195
description:
Jan 27 03:01:57 ait sshd[2612234]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.94.195


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.113.51.55
description:
2025-01-27 03:02:28 dovecot_login authenticator failed for ([185.113.51.55]) [185.113.51.55]:34918: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.127.143.140
description:
2025-01-27 03:02:41 dovecot_login authenticator failed for ([116.127.143.140]) [116.127.143.140]:41760: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.120.58.228
description:
Jan 27 03:02:54 ait sshd[2612683]: pam_imunify(sshd:auth): [IM360_RBL] The IP 116.120.58.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.153.62.100
description:
Jan 27 03:03:10 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.153.62.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.62.100
description:
2025-01-27 03:03:12 dovecot_login authenticator failed for a89-153-62-100.cpe.netcabo.pt [89.153.62.100]:46794: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.130.18.21
description:
Jan 27 03:03:17 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.130.18.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.17.90.246
description:
Jan 27 03:03:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.17.90.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.127.143.140
description:
Jan 27 03:02:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.127.143.140 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 116.120.58.228
description:
Jan 27 03:02:54 ait sshd[2612683]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=116.120.58.228


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.130.18.21
description:
2025-01-27 03:03:19 dovecot_login authenticator failed for 220-130-18-21.hinet-ip.hinet.net [220.130.18.21]:47888: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.17.90.246
description:
2025-01-27 03:03:04 dovecot_login authenticator failed for syn-072-017-090-246.biz.spectrum.com [72.17.90.246]:54220: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 34.64.231.231
description:
Jan 27 03:03:06 ait sshd[2612922]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=34.64.231.231  user=root


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.167.140.130
description:
Jan 27 03:03:33 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.167.140.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.167.140.130
description:
2025-01-27 03:03:35 dovecot_login authenticator failed for (109-167-140-130.westcall.net) [109.167.140.130]:44899: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 111.231.56.128
description:
Jan 27 03:04:11 ait sshd[2613625]: Invalid user geruestbau-schleifer.de 2001 from 111.231.56.128 port 39026


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.231.56.128
description:
Jan 27 03:04:12 ait sshd[2613625]: pam_imunify(sshd:auth): [IM360_RBL] The IP 111.231.56.128 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 111.231.56.128
description:
Jan 27 03:04:12 ait sshd[2613625]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=111.231.56.128


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.152.6
description:
Jan 27 03:04:28 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.152.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.159.152.6
description:
2025-01-27 03:04:30 dovecot_plain authenticator failed for (inearrock) [93.159.152.6]:37368: 535 Incorrect authentication data (set_id=nkbosomefi@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 210.180.118.166
description:
Jan 27 03:05:05 ait sshd[2613907]: Invalid user universitypublishing from 210.180.118.166 port 59458


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.180.118.166
description:
Jan 27 03:05:06 ait sshd[2613907]: pam_imunify(sshd:auth): [IM360_RBL] The IP 210.180.118.166 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 210.180.118.166
description:
Jan 27 03:05:06 ait sshd[2613907]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.180.118.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.65.238.250
description:
Jan 27 03:05:27 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.65.238.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.65.238.250
description:
2025-01-27 03:05:29 dovecot_plain authenticator failed for (prealcous) [185.65.238.250]:56238: 535 Incorrect authentication data (set_id=adom-oduro@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.197.126.103
description:
Jan 27 03:04:45 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.197.126.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.197.126.103
description:
2025-01-27 03:04:47 dovecot_plain authenticator failed for (licend) [2.197.126.103]:59212: 535 Incorrect authentication data (set_id=ads76a66686y@ait.edu.gh)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 37.22.66.126
description:
[2025-01-27 03:05:40 +0100] info [webmaild] 37.22.66.126 - info@aitlemass.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.42.113.10
description:
Jan 27 03:05:51 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.42.113.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.42.113.10
description:
2025-01-27 03:05:53 dovecot_login authenticator failed for ([182.42.113.10]) [182.42.113.10]:39105: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.202.154.83
description:
Jan 27 03:06:07 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.202.154.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.154.83
description:
2025-01-27 03:06:09 dovecot_login authenticator failed for (m121-202-154-83.smartone.com) [121.202.154.83]:21117: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 173.95.24.68
description:
Jan 27 03:06:52 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 173.95.24.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.95.24.68
description:
2025-01-27 03:06:54 dovecot_login authenticator failed for syn-173-095-024-068.biz.spectrum.com [173.95.24.68]:4445: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.103
description:
Jan 27 03:07:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.103
description:
2025-01-27 03:07:18 dovecot_login authenticator failed for 111-70-49-103.emome-ip.hinet.net [111.70.49.103]:43033: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.51.104.242
description:
Jan 27 03:07:29 ait sshd[2614764]: pam_imunify(sshd:auth): [IM360_RBL] The IP 122.51.104.242 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 122.51.104.242
description:
Jan 27 03:07:29 ait sshd[2614764]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=122.51.104.242


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 175.125.93.101
description:
Jan 27 03:07:37 ait sshd[2614810]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=175.125.93.101


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.146.133.117
description:
Jan 27 03:07:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.146.133.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.146.133.117
description:
2025-01-27 03:07:51 dovecot_login authenticator failed for ([218.146.133.117]) [218.146.133.117]:40982: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 122.51.104.242
description:
Jan 27 03:07:31 ait sshd[2614764]: Failed password for invalid user simatime.com 2604 from 122.51.104.242 port 37834 ssh2


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.27.4.98
description:
Jan 27 03:09:06 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.27.4.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.27.4.98
description:
2025-01-27 03:09:08 dovecot_login authenticator failed for (98.4.27.218.adsl-pool.jlccptt.net.cn) [218.27.4.98]:55056: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.215.216.72
description:
Jan 27 03:09:16 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.215.216.72 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.216.72
description:
2025-01-27 03:09:18 dovecot_login authenticator failed for ([41.215.216.72]) [41.215.216.72]:33768: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.193.47
description:
2025-01-27 03:09:03 dovecot_plain authenticator failed for (blacide) [65.20.193.47]:49463: 535 Incorrect authentication data (set_id=awadzie@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.72.171.210
description:
Jan 27 03:09:22 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.72.171.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.72.171.210
description:
2025-01-27 03:09:24 dovecot_login authenticator failed for ([91.72.171.210]) [91.72.171.210]:54163: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.193.47
description:
Jan 27 03:09:01 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.193.47 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 181.188.178.215
description:
[2025-01-27 03:10:26 +0100] info [webmaild] 181.188.178.215 - info@aitstaff.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.107.247
description:
Jan 27 03:09:39 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.107.247 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.160.166.161
description:
2025-01-27 03:09:51 dovecot_login authenticator failed for ([121.160.166.161]) [121.160.166.161]:40734: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.160.166.161
description:
Jan 27 03:09:49 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.160.166.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.188
description:
Jan 27 03:09:54 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
description:
2025-01-27 03:09:57 dovecot_login authenticator failed for 111-70-49-182.emome-ip.hinet.net [111.70.49.182]:40369: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.59.134.177
description:
Jan 27 03:09:40 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.59.134.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.45.196
description:
2025-01-27 03:10:04 dovecot_login authenticator failed for ([61.79.45.196]) [61.79.45.196]:3306: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service
abuser: 45.7.64.120
description:
[2025-01-27 03:10:26 +0100] info [webmaild] 45.7.64.120 - info@ait-open.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.49.182
description:
Jan 27 03:09:55 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.49.182 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.79.45.196
description:
Jan 27 03:10:02 ait auth[2490636]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.79.45.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.59.134.177
description:
2025-01-27 03:09:42 dovecot_login authenticator failed for ([103.59.134.177]) [103.59.134.177]:3514: 535 Incorrect authentication data (set_id=support@ait.edu.gh)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.188
description:
2025-01-27 03:09:56 dovecot_login authenticator failed for ([111.61.176.188]) [111.61.176.188]:46058: 535 Incorrect authentication data (set_id=support)


